Well, it might be that your /dev/null was deleted and then some process started to write to it. Then, it would be created again as a regular file. You could've tried to read what in it before deleting it, then you'd had an idea what process wrote to it right after it reappeared. That might have given you an idea of what happened.
Some people suggest creating a cron job like this
test -c /dev/null || echo "/dev/null is missing or a regular file."
PS. Have you by any chance, compiled a kernel as root recently?
