It looks like (probably) an sftp user/process signed on and dropped a file in the root filesystem that caused it to fill from ~80% to 100%
our monitoring service was alerted and deleted the file - but not before we got a core dropped in / root directory. Definitely something dropped a file there.

Still not clear what made the sendmail.cf file disappear though - the tech that cleaned up the file also trimmed the logs while he was on but nothing about /etc/mail/sendmail.cf

so that is still a mystery to be solved.

The core file has been sent to HP to see what they can make of it.