With a bit of investigating, you can probably find the culprit. You say that there are tmp files being written all own by apache. That means it's a web script that's probably been uploaded somewhere. Soo, what you need to do is write down the timestamps that the files in the tmp/ directory have.
Once you have those, you need to look through all of your webserver access logs, for all domains. Scan through them and look for the dates that you have written down. It takes some time for sure, especially if you have a lot of domains. More than likely it's going to be a POST log entry, but could be a GET. Eventually you'll find an entry with the same timestamp, maybe a second or two off depending on how long it takes to write the tmp file, that looks a bit odd.
When you find the entry, you'll know where the script is at.
