Some thing you can do to see what is running etc..
ps aux|grep ^nobody
ps aux|grep sh
ls -al /tmp|grep -v sess
I'd also check /dev/shm (if it's 777), /var/tmp (if it's not symlinked to /tmp), and everything in /tmp.
Furthermore, you may want to look into using suexec and phpsuexec.