Multiple Logins Compromised... Help.

Basically this is what happened.

We started noticing and recieving e-mails from our uplink about sub-domains created on our machine via some of the accounts that exist on the server. I then went in, checked the logs and confirmed it was a port 2082 login to those accounts(which were mine). The passwords on both accounts were different from each other as well as different from root, but to be on the safe side I changed all 3 passwords for root and the other 2 accounts used to add the phishing sites.

Moving on, I noticed today that within a couple of weeks on the last incident I was getting logins via cpanel on 4 other accounts, none of which were mine(customers). I went in and removed the subdomains on those accounts, but the passwords in question were NOT bruteforced. I had strong passwords on my accounts that were compromised and I'm curious what I should be looking for to be able to tell HOW someone could obtain my passwords in cleartext. I have rootkit checkers that are up to date, I have APF and BFD installed and working properly. I'm at a loss and I'm hoping someone can offer some insight as to what could be occuring. Thanks in advance.

Versions are as follows:
WHM 10.8.0 cPanel 10.9.0-R139
CentOS 3.8 i686 - WHM X v3.1.0

Sincerely,

Patrick Jones

 

cPanel access_log shows a user logging in and immediately adding subdomains/adding dirs/etc... and the ftp log shows someone ftping in several files(assuming for the phishing sites) and leaving. Thats all they do. I haven't logged any bruteforce logins to any cpanel user. It just seems REALLY odd that 4-5 accounts are compromised within a 2 month span. A lookup on the IPs stated they originated from Africa, so I blocked the entire block this recent time. The IPs were one person per incident so 2 in total.

I am looking for any reasons on how this could occur like it is has been and if/where any vulnerabilities could be. nobody besides myself has root access, I've been all over the logs to no avail. Any help in this situation would be great.