Check if your box has been compromised and if it used as spam relay or amplification box. Use iostat, netstat, lsof, top, strace. Locate problematic process, i

Check if your box has been compromised and if it used as spam relay or amplification box. Use iostat, netstat, lsof, top, strace. Locate problematic process, incoming and outgoing traffic, unexpected open ports, check mailboxes user and system folders.... In any case use the usual tools to narrow the problems by process, socket status, user, ips, scenarios. If the problem fade with a reboot you can be the target or being part of a botnet.