i'm almost sure that it was caused by an incoming SMTP connection (mail from a Solaris machine).
Anything i should watch for next time it happens?
-- mingo