use top to get the pid of any processes that are monopolizing the cpu, then run "ps aux | grep <pid>" to find out which mysql, java, etc process. also check the cpu usage breakdown (specifically, what % is iowait)

here is the bug for restricting access to lists: Bug 7104 - Distribution List Restrictions. until that gets implemented, there is a "RestrictPostfixRecipients" wiki guide to setting this up manually