1. In leaked files, there is authorized_keys file in .ssh directory. Perhaps, while unpacking the files, you have overwritten your keys with those inside tarball.
2. By default, the server is set to restart at 5 am. It is set in z-999-initial-data.sql file, both for sqlite and postgres...