For those of you who use classic cron(8), have you checked /var/mail/root lately? Could be getting pretty chunky you know.
@rk Or if you've got sshd listening on a publicly-accessible port, /var/log/btmp
. Mine's currently sitting at 726MB.
(I should probably set up some log rotation.)