I've had similar experiences. Granted this isn't always the solution, but the times I have investigated something along these lines, I have found a customer, who has a poorly (perhaps intentionally) written formail CGI, which doesn't verify how it got the data to send, or even who its sending to. Some people come along, realize this, and just found themselves a nifty, free remailer, which will pass most spam checking due to the fact that it orginated within the network (provided it targets local recipients).

The first thing I do now, in situations like your own is parse the messages file to see how much mail was pushed in a given time frame and if that correlates with my down time.

Just my .02 USD

/* And the Creator, against his better judgement, wrote man.c */