[Chewie71]

1) Is this a Zimbra Only box? Does it do more?

Yes...currently Zimbra only. I found sendmail running earlier which was interfering with the mta, but I got that resolved.

2) Do you have any IMAP users?

Yes, that's mainly how we access Zimbra (Thunderbird), but it hasn't worked either since this problem started.

3) Make sure that Zimbra is TOTALLY stopped (ps auxx | grep zimbra)

root     30357  0.0  0.0  4564  756 pts/0    S    13:38   0:00 su - zimbra
zimbra   30361  0.0  0.1  5488 1236 pts/0    S+   13:38   0:00 -bash
root     21656  0.0  0.0  4056  644 pts/1    R+   17:02   0:00 grep zimbra

4) Can you post the output of both:
su - zimbra
crontab -l

# ZIMBRASTART -- DO NOT EDIT ANYTHING BETWEEN THIS LINE AND ZIMBRAEND
#
# Log pruning
#
30 2 * * * find /opt/zimbra/log/ -type f -name \*log\* -mtime +8 -exec rm {} \; > /dev/null 2>&1
#
# Status logging
#
*/2 * * * * /opt/zimbra/libexec/zmstatuslog
*/10 * * * * /opt/zimbra/libexec/zmdisklog
#
# Backups
#
# BACKUP BEGIN
# BACKUP END
#
# crontab.ldap
#
#
# Spam training cleanup
#
45 23 * * * /opt/zimbra/bin/zmtrainsa --cleanup >> /opt/zimbra/log/spamtrain.log 2>&1
#
# crontab.store
#
# Log pruning
#
30 2 * * * find /opt/zimbra/tomcat/logs/ -type f -name \*log\* -mtime +8 -exec rm {} \; > /dev/null 2>&1
0 2 * * * /opt/zimbra/libexec/zmroll_catalina > /dev/null 2>&1
#
# Purge messages
#
0 3 * * * /opt/zimbra/libexec/zmpurgemessages > /dev/null 2>&1
#
# Clean up the quarantine dir
#
0 1 * * * find /opt/zimbra/amavisd/quarantine -type f -mtime +7 -exec rm -f {} \; > /dev/null 2>&1
#
# Table maintenance
#
30 1 * * * /opt/zimbra/libexec/zmmaintaintables >> /dev/null 2>&1
#
# crontab.logger
#
# process logs
#
00,10,20,30,40,50 * * * * /opt/zimbra/libexec/zmlogprocess > /tmp/logprocess.out 2>&1
#
# Graph generation
#
10 * * * * /opt/zimbra/libexec/zmgengraphs >> /tmp/gengraphs.out 2>&1
#
# Daily reports
#
10 1 * * * /opt/zimbra/libexec/zmdailyreport | /opt/zimbra/postfix/sbin/sendmail root
#
# crontab.mta
#
#
# Queue logging
#
0,10,20,30,40,50 * * * * /opt/zimbra/libexec/zmqueuelog
#
# Spam training
#
0 23 * * * /opt/zimbra/bin/zmtrainsa >> /opt/zimbra/log/spamtrain.log 2>&1
#
# Dspam cleanup
#
0 1 * * * find /opt/zimbra/dspam/var/dspam/data/z/i/zimbra/zimbra.sig/ -type f -name \*sig -mtime +7 -exec rm {} \; > /dev/null 2>&1
8 4 * * * /opt/zimbra/dspam/bin/dspam_logrotate -a 60 /opt/zimbra/dspam/var/dspam/system.log
8 8 * * * /opt/zimbra/dspam/bin/dspam_logrotate -a 60 /opt/zimbra/dspam/var/dspam/data/z/i/zimbra/zimbra.log
#
# Spam Bayes auto-expiry
#
20 23 * * * /opt/zimbra/libexec/sa-learn --force-expire --sync > /dev/null 2>&1
#
# Clean up amavisd/tmp
#
15 5,20 * * * find /opt/zimbra/amavisd/tmp -maxdepth 1 -type d -name 'amavis-*' -mtime +1 -exec rm -rf {} \; > /dev/null 2>&1
# ZIMBRAEND -- DO NOT EDIT ANYTHING BETWEEN THIS LINE AND ZIMBRASTART
[zimbra@mail ~]$

and

ps -ef | grep tomcat

[root@mail log]# ps -ef | grep tomcat
root     21697  6230  0 17:04 pts/1    00:00:00 grep tomcat

Also, let's look at the mysql memory for kicks:
zmlocalconfig | grep mysql

[zimbra@mail ~]$ zmlocalconfig | grep mysql
logger_mysql_bind_address = localhost
logger_mysql_data_directory = ${zimbra_home}/logger/db/data
logger_mysql_directory = ${zimbra_home}/logger/mysql
logger_mysql_mycnf = ${zimbra_home}/conf/my.logger.cnf
logger_mysql_pidfile = ${zimbra_home}/logger/db/mysql.pid
logger_mysql_port = 7307
logger_mysql_socket = ${zimbra_home}/logger/db/mysql.sock
mysql_bind_address = localhost
mysql_data_directory = ${zimbra_db_directory}/data
mysql_directory = ${zimbra_home}/mysql
mysql_innodb_log_buffer_size = 8388608
mysql_innodb_log_file_size = 104857600
mysql_logger_root_password = *
mysql_memory_percent = 40
mysql_mycnf = ${zimbra_home}/conf/my.cnf
mysql_pidfile = ${zimbra_db_directory}/mysql.pid
mysql_port = 7306
mysql_read_buffer_size = 1048576
mysql_root_password = *
mysql_socket = ${zimbra_db_directory}/mysql.sock
mysql_sort_buffer_size = 1048576
mysql_table_cache = 500
zimbra_logger_mysql_password = *
zimbra_mysql_connector_maxActive = 10
zimbra_mysql_password = *
zimbra_mysql_user = zimbra