You do have all of the latest patches installed and are running the current kernel, right? Some investigation of the files the users installed and the commands they ran if we're lucky (some of these people forget to clear .bash_history) would be very helpful, 'cause it sounds like we've got an unpatched exploit....
I use Fedora Core 3, and I installed all the updated rpm's. I use a kernel 2.6.12-rc3-RT-V0.7.46-02 (Ingo Molnar's patch)