that’s what i suspect, but they’re denying it. and i’m unfortunately not geek enough to figure out if i can prove they did this by looking at logs.
i’m currently reinstalling, this time manually, and will set-up a nightly cron backup, so am keeping my fingers crossed.