I swear your shit is most likely hacked
the script kiddies on IRC are looking for ways to profit after rooting your box
MAJOR holes major major major holes
there is an app now that just about just ask the kiddy to put in URL and click go after he clicks go the script auto hacks the entire server ( even jailed accounts ) and sets ups a bot on a hidden IRC channel
from here it is realy bad biz since not only the kiddy has access but whoever it it whom wrote the script
you are especialy vuln if you run any type of host manager software like cpanel , ensim, plesk, etc etc
just an FYI
good night