Since various things live in the linux /var partition, such as the mail queue and databases, I decided to start the investigation in the mail queue. After probing around a bit in the queue, I noticed over 300 emails waiting for delivery and many of them were the same size (sure sign of spamming). Checked the FROM: lines in the mail headers of the suspected messages and they all were being sent from the server itself. Someone was cc\'ing a bunch of aol addresses. Found mail script that had been exploited and took care of it. Now thw /var part is back to normal.
 
I hope this helps someone else. Lucky I found this BEFORE getting the server blacklisted