I know part of the reason for this, as we are trying to catch a PHP or Perl script that is abusing the server and sending over 100mb/s outgoing for short bursts of 30-45s at a time. It is probably intertwined with the issue you are seeing. The bursts last such short time by the time we get logged in it is over, highly annoying.