It seems that certain lines added to our wp-config.php file are being removed, every day at 01:00.
The line that's being removed is
Which is added just before the /* That's all, stop editing! Happy blogging. */ line.
The site is hosted on WPMU, and they say there's nothing they do that would do this. Our WP developer who created the theme says also there's nothing that would do it either. I also can't find anything in any plugin that would do it.
I've checked the cron jobs listed and there's a bunch of WP_Defender jobs, for example, that I have no idea what they do, but they don't seem to run at the correct time for the activity (nothing seems to fire around that time).
I haven't disabled all the plugins and re-enabled them, as we'd have to do it one per day and it would take a month!
Any ideas how I could track down what's doing this?