Configuration (config.yaml) changed by what ever?

after some days doing some other stuff, I wanted to start a 3D print job.
But on the web user interface there where no files shown at all.
Reason: the directory settings at config.yamal had been changed by a ghost.

actual config file:

(...)
feature:
    printStartConfirmation: true
    sdSupport: false
folder:
    timelapse: /mnt/usb1/octoprint/timelapse
plugins:
    DisplayLayerProgress:
        sendLayerInformationsViaWebSocket: false
(...)

my backup of config file:

(...)
feature:
    printStartConfirmation: true
    sdSupport: false
folder:
    logs: /mnt/usb1/octoprint/logs
    timelapse: /mnt/usb1/octoprint/timelapse
    timelapse_tmp: /mnt/usb1/octoprint/timelapse/tmp
    uploads: /mnt/usb1/octoprint/uploads
    watched: /mnt/usb1/octoprint/watched
plugins:
    DisplayLayerProgress:
        sendLayerInformationsViaWebSocket: false
(...)

How can this happen?
Definitely nobody has attached OctoPrint configuration since last print and there was everything as it should.
Surely in the mean time the Pi had to do other work and was started and stopped several times. Because OctoPrint is configured as daemon it had been started several times also. But it was just in the background without doing some prints.

Ok, at the end it was not really a problem. Just stop Octoprint, restore security copy of config.yaml and restart Octoprint and everything was right again.
But: how can this happen? (Octoprint V. 1.4.2 ahead Python 3.6.x, Pi 3B+ with full Pi Ubuntu Stretch)