You can find the process that's binding the port on that server with
sudo netstat -apn|grep -w X
It seems very likely to be the half-defunct sshd, but why make assumptions when you can have data? It's also a good way for a script to find a PID to send signal 9 to before trying to bring the tunnel up again.
