"... external hosting service" Can ya get such access where you host? Am one who happens to believe that one cannot effectively admin a DYI moodle without terminal/ssh access.
Clone on same environment is typically a good idea ... cept in your case - where you don't have access and could use git versioning for moodle code! 
The log files might have been very old since they were never in log rotation ... only by looking at the head of one of those to see first entries and then tail of one of those to see the last entries would one know for sure.
Is that the only error_log file you found?
Zero Day Flaw/exploit:
You've never heard of that? Guess security of site has been off your radar screen! It's not necessarily Moodle code but other stuff ... that might be vulnerable ... or XSS where no authentication/login required to do dirty things!
'SoS', Ken