I think I found the culprit. I had a forum that was disabled and there was a picture gallery in there. The pic gallery got compromised and was acting like a spam zombie or something. My webhost is happy now.
A bunch of traffic was coming from an IP that led back to nelnet, but it was prob not them.