And I can't think of any reason that atd should be listening on the network.

Yes, especially on smpts. Robricc, you have definitely been own3d.

Checking `lkm'... You have 6 process hidden for ps command

That's a bit of a giveaway too.

Peter