Fakeproc causing high cpu utilization

I recently was called for help by a WordPress based site owner, suspecting that her site was hacked and cpu utilization of her Ec2 instance was pegged at 100%. She rebooted to remedy the situation, hence I initially could not find anything wrong, no suspicious processes running and network socket connections seemed fine.

The next day she contacted me again, this time right away while her site was bogged down. Despite extremely high cpu utilization, I was able to ssh into the instance ...