The symptom was database crashes. The cause was a webshell.
A production Zimbra mail server we operate started crashing its database. That is the kind of symptom that leads a tired administrator to restart the database, watch it stay up for a while, and move on.