I know this is an old thread, but others are bound to ask the same questions, so I thought I would suggest tools for locating that file that performs the rotation.
One very basic tool is qcoptest, which logs all messages to qtopia, qcop messages. I personally have not seen anything in it indicating where the rotation comes from, but on my sl6000, every time I change between applications, the rotation message appears in the log. I have more info about qcoptest at the following:http://sdjf.esmartdesign.com/ipks/qcoptest.html
The other ways to find out what is going on are to either enable syslogd and view all activity, or run strace when you start an application. Both can create voluminous output, I think strace would be more informative. You could start any app from commandline using strace, and then while the app is still open, change your orientation and see what happens in the logs in both qcoptest and strace.
A tip for using strace is to allow longer character strings, I think the default is low, maybe 60 characters, and I prefer to up that to 100 or 200 characters so the ends of lines do not get snipped off in the log.