I haven't sent an email as yet :) If it's of any use until I can grab an output for you (I had to put a script in place to delete logs and restart server, to stop site going down):
There's a LOT of these:
litespeed 3673 nobody DEL REG 0,5
3342576105 /dev/zero
litespeed 3673 nobody DEL REG 0,5
3342576104 /dev/zero
litespeed 3673 nobody DEL REG 0,5
3342576103 /dev/zero
litespeed 3673 nobody DEL REG 0,5
3342576102 /dev/zero
litespeed 3673 nobody DEL REG 0,5
3342576065 /dev/zero
litespeed 3673 nobody DEL REG 0,5
3342576064 /dev/zero
litespeed 3673 nobody DEL REG 0,5
3342576063 /dev/zero
The majority of the rest of the lsof output is like this:
litespeed 3673 nobody 4088r REG 202,1 44387 677921 /home/(userfolder)/public_html/assets/images/site/(imagename).jpg
litespeed 3673 nobody 4089r REG 202,1 24383 734870 /home/(userfolder)/public_html/assets/images/site/(imagename).jpg
litespeed 3673 nobody 4090r REG 202,1 30102 684496 /home/(userfolder)/public_html/assets/images/site/(imagename).jpg
litespeed 3673 nobody 4091r REG 202,1 150256 708987 /home/(userfolder)/public_html/assets/images/site/(imagename).jpg
litespeed 3673 nobody 4092r REG 202,1 49191 719539 /home/(userfolder)/public_html/assets/images/site/(imagename).jpg
(Identifying data removed)
Apart from a handful of files, the vast majority are images, all in this state.