I think /var/tmp is on rootfs and if you opened any email attachments they might be living there... mine were.

And the usual, if you installed anything that is not optified it could be screwing up your rootfs usage as well.