Could also be a nicehash user.  Or someone remotely changing config files.

To anyone worried about remote changes, set -mport 0 (disable), or -mport -3333 (negative ports make remote monitoring read only), default is 3333 (full remote access via ethman).

You can also go here https://www.grc.com/x/ne.dll?rh1dkyd2 to check if port 3333 is open to the outside world, and change router settings if it is.