My server's been hacked EMERGENCY
I run a couple of sites on Ubuntu via Rackspace Cloud Server. My site typically uses about 3 GB of outbound bandwidth a day. Today, I was shocked to discover that for the past week, my server has logged 2 Terabytes of outbound bandwidth a day. This is obviously completely abnormal and is costing me an arm and a leg. Interestingly, awstats shows my sites have been using the typical amount of bandwidth, so it's something else that's causing this ridiculous spike.
I suspect my site has been hacked. I ran root checks, went through my server logs, and found nothing suspicious. Do you guys have ideas on what else I can do to figure this out?