The issue was found, after reviewing the logs further. The server had been hacked, we had an IP from Denmark that had gained admin rights to the server.
I reloaded fresh, restored from a recent backup, and updated, everythings up and running again, with fresh new complex passwords.