This should be considered a security issue - lighty just starts out of nowhere because of the wrong reload commands.
Even if it is stopped or not even started on any runlevel. See https://bugs.launchpad.net/ubuntu/+source/lighttpd/+bug/393792 - I guess it's the same for debian...
