کد PHP:
the backup-files are usualy from /home/
but on your server you have many another files, ex: /root or /tmp
edit :
Try to go to main >> account functions >> raw apache log download on your cpanel,
and download the logfiles, and read it, if you have seen anything bad or shady, it could be hacking attack too.