I have a weird thing going on. Recently our tmp reported that it was full and X stopped functioning, checking the disk usage we found out that root partition is full. But actually it isn't.

du reports

6.8M /bin
5.2M /boot
339K /dev
19M /etc
1.9G /home
1.0K /initrd
41M /lib
12K /lost+found
763M /misc
3.0K /mnt
1.3M /opt
1.0K /proc
4.6M /root
14M /sbin
29K /tftpboot
0 /tmp
5.0K /tmpsave
2.7G /usr
350M /var

where / usage is less than 90mb and / partiton is 500 mb itself.
But still df reports :

Filesystem 1K-blocks Used Available Use% Mounted on
/dev/hda5 505605 490003 0 100% /
/dev/hda1 101089 9379 86491 10% /boot
/dev/hda3 9716828 1928996 7294236 21% /home
none 127092 0 127092 0% /dev/shm
/dev/hda2 26589228 2802552 22436012 12% /usr
/dev/hda6 1027768 396872 578688 41% /var
//sinclair/benjamin$ 78172160 5611520 72560640 8% /misc/backup

We run fsck to make sure no disk errors present, rebooted several times to make sure open files are closed but still can't fixed the problem. I moved root and tmp directory to another partition creating symlinks, which enable me to run X again.

Any ideas how to resolve this problem and regain 400MB back?