User public_html completely wiped

Hi all,
although I have backups, I am trying to get to the root cause of this. There is no file on public_html folder and the user said they didn’t even login. I am trying to check log files and what else I should investigate to find out what happened.

I only have 1 ssh user and password login is disabled!

Any help or pointers would be appreciated!