can wallet be bruteforced? How long would it take for a 8 char (small+caps+digits)? Quite some time I would assume.
Within ~5 months? I would guess so, yes.
But this depends on the hardware the attacker is using and the efficiency.
I'd still believe that your file server has been somehow compromised.