I figured out the problem as soon as I saw that the site uses wordpress... it's wordpress. I set up a couple of WP installs recently, both specifically set to NOT automatically "upgrade" (to me auto upgrades are like having a car that can decide what engine it wants on any given day), but WP just ignored that setting and upgraded anyway. I despise lying software almost as much as lying politicians.