Hi, you can mark it as "RESOLVED" but the fact is it is not and you are not right with your statement, it is WHMCS related.
After further investigation, they used the Plesk 'admin' account to be logged in and also as you can see in the last log line, they changed the 'Access to the server over...