Did you look at the code the transaction was executing before you killed it? It could have created huge temptable(s), or sorting an extreme dataset, or.... And did you look at the user hat was executing the killed action or from what host the action was coming from? These info could give you a starting point for your investigation.