I agree, at 1M hits/month, you should have separate db and web servers, and should probably design your apps to be load balanceable (i.e. data only stored in a central datatbase, not local text files etc...)
If you split the boxes out, you can use a fast box for the db, and any old PII 400 for the front end should do just fine.