We have a very similar issue.
OS: CentOS release 5.8 (Final), plesk psa-9.5.2-cos5.build95100504.10
Running litespeed, qmail, php, multiple vhosts (some have wordpress but we are not sure if this is the exploit path).
The server was bogged down with the email spam blast. I stopped qmail so...