Sorry I've been quiet on this--trying different things. I don't have a spare hub lying around, but there's one *outside* the PIX, which shows me everything using Ethereal (which puts my NIC in promisc mode automatically, Greg). I can then map ports with the PIX's PAT log (show xlate) and track down traffic.
Found a LAN client which was sending spam.
But I still haven't found the major culprit. :(
Doing the unplug dance as I can.