For info, I’ve got some scripts monitoring this now: every five minutes, they check the theme is still correct and if not, it gets corrected. The theme reverted once, overnight, and I therefore had five minutes of Apache logs to inspect, presuming one of the hits to be responsible.
None of the entries in the Apache logs were unusual (i.e. nothing strange, just normal page loads and RSS feed reading). Just for good measure, I manually loaded all the links in the five minute window where the theme reverted and … nothing happened to the theme.
This is very strange, no?