Thank you for your help!
Yes, everything is set as you've stated here in the first place so must be a malicious file or wrong server config can cause the trouble.
I've checked the site and found this suspicious entry:
/var/sites/y/yogatherapy.org/public_html/administrator/components/com_sef/classes/seftools.php
Pattern 21 - At least two characters in hexadecimal or octal notation.
Found 1 occurence(s).
Details: Found at least two characters in hexadecimal or octal notation. It doesn't mean it is malicious, but it could be code hiding behind such notation.)
I'll do further investigation.
Thank you anyway!