I use webmin/usermin (BSD licence) instead of Cpanel (proprietary).

I hope your'e patched up. Script kids have been doing the rounds with a file disclosure exploit in Webmin/Usermin for a while now. Thousands of machines have been compromised by it.

Check the miniserv.log for "..%01/..%01/..%01" or similar strings.