1) The root Shell entry in /etc/passwd looks wrong to me. Is it really /user/bin/bash ?
When was the root Shell changed to bash ?
The root passwd entry has no UID and GID fields.
Anybody know what is going on here?
If you grep "root" /etc/passwd do you only find one line?

2) Please post the full directory listing because the timestamps, file permissions and file sizes could be important.

Code:

ls -la /var/spool/cron/crontabs

3) Please post:
Three most recent consecutive comand and error entries from the cron log complete with timestamps.
Can you match these to actual crontab lines?
I'm asking this because cron can also run "at" jobs and to determine whether cron is still running and to check where it is finding the failing jobs.