If I open the wallet file in plain text, it shows random characters and numbers, not plain addresses or private key.
If you don't see ANY plain text when you open the wallet file in a text editor... and it's all just random chars, you have full encryption.
However, reading through all the symptoms, I think Abdussamad is correct. If the wallet file is using the same seed etc, but showing different addresses, then it would appear that the wallet file was tampered with somehow

Yeah I have accepted the fact that the wallet file has been tampered, and understand that there is close to zero chance for it to be recovered, just not sure how that happened.
When I am creating wallet, I am very careful with the process, and that wallet is not my first time so I am fully aware of the process. So it's either my computer has been compromised or simply human error.