Umbraco is magically reverting to “Looks like there's more work to do”

[onnslmsbnwb]

I have a client and he has reported that 5/6 times, the website has somehow returned to unpublished mode. We are unsure what could be causing it and generally it will happen when no one is working on the website at all. They do have some people who have in the past and may still have malicious intentions with regards to bringing the site down (so this could also be an issue).[*]Are there any known security issues in Umbraco whereby a user could malicious unpublished the entire website?[*]Are there any bugs in Umbraco that could cause this to happen?[*]Does Umbraco check the Database for published flag, or does it just check for the existence of the XML file before choosing to show the "there is more work to do" message?