the best way to solve such issues will be to automate the alerts when server acts wierd. There are softwares available to handle such situations. It also depends on what type of abuse it is. If it is email, you need to monitor the mail log, if its apache, you need to check the incoming connections and access log, if its downloaded and executed via the host, you need to keep track of /tmp directory....etc.
I do not think we have a single monitoring tool which does everything on its own. There are separate ones available like PRM, MailScanner and so. If anyone has suggestions, it would be helpful...