This sounds like a very interesting criminal case ...
I cannot think of any bug that causes such behavior, but really tend to believe that your client is under attack by a very rogue human or a very malicious and sophisticated and yet unknown software.
Are the hosts using shared (SAN) storage or only local disks? Are they managed by vCenter?
Are there any other products interacting with the hosts or vCenter? vCloud Director, Lab Manager or something?
Have you checked the hosts for unusual crontab entries or suspicious VIB files installed?
Have you considered re-installing all hosts?
How about limiting remote access (https for the API and ssh) through the hosts' firewall to well known and clean workstations?