Removing the inode pointing to a file doesn't mean the file is really removed. As long as a process still has an open handle to that file it can continue to read
and write to that file. Only when that handle is closed too, the space is reclaimed.
The difference between df and du is also explained by this. df checks for used/unused inodes and blocks (asking the FS module for that data), while du just checks the directory indexes for files. If a file is removed but still in use, that space is marked used in the file system (seen by df), while du can't see it anymore.
Next time, check with
lsof or
fuser which process and user is accessing that file.