Are the images physically removed from the uploads directory, or just missing from the Media Library?
There are other strange things happening that may be related to the current brute force attack. No one seems to know what the goal of this attack is, but there are over 90,000 attacker IPs involved. This indicates a huge botnet of attacking IPs. I have had over 14,000 brute force hack attempts on one of my sites since that began.
I've seen a new user named email@example.com installed on some sites. I think that is a backdoor that the attack installs that lets a hacker in at a later date.