how to trace who is abuse the resources?

I founded my serverload always 1.5 above, i try /top at ssh, i notive that the mailman, mailnull, nobody often in running.
anybody can tell me how to trace who is abuse the resources?

This is my top capture picture.

http://66.220.27.180/ssh.gif

 

 

 

 

Top