recently had same problem on a system at work, kept on doing it, we'd
reboot it and it'd be ok for a while, then report disk full again
while du not showing more than 5% in use.
Turns out a PHP program had snowballed in a bad way and was rapidly
filling up /var/log/something although we couldn't see the files for
some reason.
I shall have to remember the "lsof | grep deleted" trick should it
ever happen again.
(probably doesn't happen anymore though, since the code was fixed.)