From a similar question on ServerFault (and particularly one response there), one possible explanation for the disparity is that there are processes hanging on to files they’ve accessed on /tmp that have since been deleted.

# lsof | grep deleted 

will list such files along with the processes still attached to them.