Thanks for the responses everyone. We did install and run rkhunter, it didn't find anything.

It looks like we actually did take care of this in the initial clean-up, but postfix was trying to resend messages that had been bounced after the host was blacklisted.

There were 100's of thousands of messages stuck in /var/spool/postfix/deferred. I think when I started postfix, it was moving those back to ./active and trying to resend. I just deleted everything in ./deferred and ./active, then started postfix. It doesn't appear that any new messages are being created or sent. I'm thinking this was just me not understanding how postfix works.

I've been running

watch -d -n 1 'ls -lhart /var/spool/postfix/active'

and 

watch 'netstat --program --numeric-hosts --numeric-ports --extend | grep -E ":25|postfix|smtp"'

For about 30 minutes and see no outgoing activity.

Server compromised - How do I find out what is sending mail
I am trying to use NSDateFormatter to convert the following string to an NSDate: 2013-08-19 7:00 AM.

However, the following NSDate is created: 2013-08-19 04:00:00 +0000. The hour is wrong.

My code is below. I don't know what I am doing incorrectly.

NSDateFormatter *dateFormatter = [NSDateFormatter new];
[dateFormatter setTimeZone:[NSTimeZone systemTimeZone]];
[dateFormatter setDateFormat:@"yyyy-MM-dd HH:mm a"];
NSString *string = @"2013-08-19 7:00 AM";
NSDate *dateFromString = [dateFormatter dateFromString:string];

