Doesn't sound like an attack, exactly. How many users were registered when you got your stats, and were the users being online ones that had been registered for at least over 1 week? Please keep in mind that Oxwall is a highly victimized software of spam bots/spam harvesters. There are scripts by services like "sickmarketing" that instantly target websites with the Powered by Oxwall logo/link and more and make multiple fake accounts, stay online (the bots never sign out), etc. Add a possible chance of spam effecting your site with the fact you just performed a PHP update and some FTP transmissions (for the plugin), I could see why server usages was at it's cap. (Also yes, even with spam prevention plugins in, some spam bots can still make accounts).

So,

-Oxwall core script constantly running and running plugin inits all the time = a good amount of usage on the entire server.

-Active users (no matter how many) and depending on if you're using CRON-heavy and jQuery/AJAX-heavy functions/plugins, this = another good amount of RAM and even some I/O.

-Possible spam accounts signing up, causing more requests to be sent causing the script to work more = more I/O, RAM, and Disk space being taken up when the other factors are given. 

That's just my theory/take on the situation. I can't really see this as an "attack." If someone wanted to make your server go offline, they'd simply perform a DDoS to your server IP and be successful.

Goodluck,

~Jake

Head of Developments

www.ewtnet.us