Comment by MartijnHols

Another theory is your server got compromised but they cleared their tracks. Not every hacker wants to make a quick few cents from a miner that gets shut down in a day or two.