Hacked??!?!?!

I don't know what prompted me to look at my graphs this morning, but I saw something extremely unusual. I noticed that all 3 were a lot higher than usage, and the network outbound was at about 700 k/s for the past few HOURS. The first thought I had was that I was hacked. I ran a root kit and checked what I know how to check on the logs, but still really don't know what it could be. SSH does not allow root logins and there is a basic IPTables firewall setup, soon to add a "brute force blocker". I shutdown the server for an hour or so and fired it back up and all looked normal for a few hours until the CPU and IO went a little higher than normal. The Network was 0.

What do my plots indicate may have happened?

~~http://www.eld101.com/cpuplot.png" />

~~http://www.eld101.com/networkplot.png" />

~~http://www.eld101.com/ioplot.png" />

Any suggestions for logs or other places/things to check?

Thanks for the help…. I am a n00b!~~