Recently, we noticed there are 4 files being constantly exported to var/export. It contains what appears to be billing/payment info for customers - even though our Magento store doesn't store any credit card information.
We've confirmed with our host that these files haven't been accessed by anyone via the logs, but no matter what we do - deleting them, renaming var/export - they are still being constantly generated with the same file name and new entries are being recorded into it.
We didn't notice any recently modified php or phtml files that would indicate a hack, not sure how to trace to the source of the problem.
Does anyone have an idea on how to check what is causing these csv files to be generated? Could it possibly be some bug or something?