@beveiligingnieuws It sounds like there might have been some customisation made to phplist, or a separate program that accesses the wordpress and phplist databases. If a program is run daily then it might be setup as a cron job. Your system admin should be able to check that for you.