Check for folders in your cPanel with any random variable names like afjhepfhwef3. Someone might have gotten access to it and uploaded their server or sent their stealer logs to it.