Try doing "top c" to see if you can pinpoint the script name - it's probably using quite a bit of resources and most likely a perl or php script. Get a PID from one of the instances and do "lsof -p PID" where PID is the one from your top command. That should tell you where the script is running. Change attributes on the script so that it cannot run, suspend the account then examine the script to make sure that was all that it was doing.
Hope that helps
Hope that helps
