PHP script spawning requests to itself in endless loop - php

Question

I'm not even sure if I'm describing this problem correctly. I think the main thing I want to know is how I can trace the source of these requests in the code.
The problem had occurred before and I "solved" it by adding a deny to .htaccess against the IP of the server itself.
The problem reoccurred suddenly and for no apparent reason. My .htaccess setting lost its magical protective power. No changes were made in the code. Around the time of the reccurrence, I changed a config setting to add a cookie domain. I tried changing it back to blank, and I tried deleting all session files (and Magento cache). If the sessions setting caused the recurrence, that should have fixed it but it didn't.
The only thing that "fixed" it was turning off the Magento setting for web server rewrites for "clean" urls along with commenting out this line in .htacces:
RewriteRule .* index.php [L]
The site now "works", with ugly urls and, mysteriously, incredibly degraded performance. 10-20 seconds for pages to load that used to take 1-2. PHP and MySQL appear to function normally now.
But with original setting after the problem happened, I was seeing a bunch of PHP instances in top from the command line. MySQL SHOW PROCESSLIST shoeds an ever-increasing quantity of sleeping processes. And my Magento website's session folder continuously added new sessions (about 1 new session per second, even though my client browser IP address was the ONLY one allowed by htaccess during this test).
From the browser on the client side, most requests time out, and rarely the page does load after a VERY long time (10+ minutes - PHP max_execution_time is long to allow for long import/export processes to complete).
A static index.php that just echoes "it works" loads without any weird errors.
I have no idea what the problem is. Is it malicious code? Is it some problem with session handling? Could it even be related to DNS? I could make progress solving the problem if I could trace the source of the "zombie" requests somehow.
EDIT: Here is my complete .htaccess file, with some things redacted ( I changed IP addresses)
############################################
## default index file
DirectoryIndex index.php
<IfModule mod_php5.c>
############################################
## adjust memory limit
# php_value memory_limit 512M
# php_value max_execution_time 10
php_value max_input_time 18000
############################################
## disable magic quotes for php request vars
php_flag magic_quotes_gpc off
############################################
## disable automatic session start
## before autoload was initialized
php_flag session.auto_start off
############################################
## enable resulting html compression
php_flag zlib.output_compression on
###########################################
# disable user agent verification to not break multiple image upload
php_flag suhosin.session.cryptua off
###########################################
# turn off compatibility with PHP4 when dealing with objects
php_flag zend.ze1_compatibility_mode Off
</IfModule>
<IfModule mod_security.c>
###########################################
# disable POST processing to not break multiple image upload
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>
<IfModule mod_deflate.c>
############################################
## enable apache served files compression
## http://developer.yahoo.com/performance/rules.html#gzip
# Insert filter
SetOutputFilter DEFLATE
# Netscape 4.x has some problemsÂ~E
BrowserMatch ^Mozilla/4 gzip-only-text/html
# Netscape 4.06-4.08 have some more problems
BrowserMatch ^Mozilla/4\.0[678] no-gzip
# MSIE masquerades as Netscape, but it is fine
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
# DonÂ~Rt compress images
SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary
# Make sure proxies donÂ~Rt deliver the wrong content
Header append Vary User-Agent env=!dont-vary
# enable resulting html compression
#php_flag zlib.output_compression on
</IfModule>
<IfModule mod_ssl.c>
############################################
## make HTTPS env vars available for CGI mode
SSLOptions StdEnvVars
</IfModule>
<IfModule mod_rewrite.c>
############################################
## enable rewrites
Options +FollowSymLinks
RewriteEngine on
############################################
## you can put here your magento root folder
## path relative to web root
# if site is at raw ip/user url like http://111.22.33.44/~users_folder/
# RewriteBase /~users_folder/
RewriteBase /
############################################
## workaround for HTTP authorization
## in CGI environment
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
############################################
## always send 404 on missing files in these folders
RewriteCond %{REQUEST_URI} !^/(media|skin|js)/
############################################
## never rewrite for existing files, directories and links
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-l
############################################
## rewrite everything else to index.php
RewriteRule .* index.php [L]
</IfModule>
############################################
## Prevent character encoding issues from server overrides
## If you still have problems, use the second line instead
AddDefaultCharset Off
#AddDefaultCharset UTF-8
<IfModule mod_expires.c>
############################################
## Add default Expires header
## http://developer.yahoo.com/performance/rules.html#expires
ExpiresActive On
ExpiresDefault "access plus 1 year"
#ExpiresDefault "access plus 1 year"
</IfModule>
############################################
## By default allow all access
Order allow,deny
Allow from all
#try denying own ip. it seems like it is sending the requests!
#this server ip e.g. 111.22.33.44
# this hack "fixed" the problem a long time ago.
Deny from 111.22.33.44
# Order deny,allow
# Deny from all
# Allow from [particular IP for testing]
<FilesMatch "\.(?:inc|ini|txt|tar|gz|sql|sh|zip|htm|html|log)$|apc.php">
Order allow,deny
Deny from all
</FilesMatch>
############################################
## If running in cluster environment, uncomment this
## http://developer.yahoo.com/performance/rules.html#etags
FileETag none
Options All -Indexes
# 4 Weeks
<FilesMatch "\.(html|htm|phtml)$">
Header set Cache-Control "max-age=2419200, must-revalidate"
</FilesMatch>
<FilesMatch "\.(js|css|swf)$">
Header set Cache-Control "max-age=2419200"
</FilesMatch>
<FilesMatch "\.(jpg|jpeg|png|gif|swf|PNG|JPEG|GIF|SWF|JPG)$">
Header set Cache-Control "max-age=2419200, public"
</FilesMatch>
<ifModule mod_gzip.c>
mod_gzip_on Yes
mod_gzip_dechunk Yes
mod_gzip_item_include file .(html?|txt|css|js|php|pl)$
mod_gzip_item_include handler ^cgi-script$
mod_gzip_item_include mime ^text/.*
mod_gzip_item_include mime ^application/x-javascript.*
mod_gzip_item_exclude mime ^image/.*
mod_gzip_item_exclude rspheader ^Content-Encoding:.*gzip.*
</ifModule>
# compress text, HTML, JavaScript, CSS, and XML
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE text/phtml
AddOutputFilterByType DEFLATE text/xml
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE application/xml
AddOutputFilterByType DEFLATE application/xhtml+xml
AddOutputFilterByType DEFLATE application/rss+xml
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript
# remove browser bugs
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4\.0[678] no-gzip
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
Header append Vary User-Agent
<IfModule mod_expires.c>
# Enable expirations
ExpiresActive On
# Default directive
ExpiresDefault "access plus 1 month"
# My favicon
ExpiresByType image/x-icon "access plus 1 year"
# Images
ExpiresByType image/gif "access plus 1 month"
ExpiresByType image/GIF "access plus 1 month"
ExpiresByType image/PNG "access plus 1 month"
ExpiresByType image/JPG "access plus 1 month"
ExpiresByType image/JPEG "access plus 1 month"
ExpiresByType image/png "access plus 1 month"
ExpiresByType image/jpg "access plus 1 month"
ExpiresByType image/jpeg "access plus 1 month"
# CSS
ExpiresByType text/css "access 1 month"
# Javascript
ExpiresByType application/javascript "access plus 1 year"
</IfModule>