Time for some more news - apparently, it was an attack. Our line got saturated with almost constant 80M transfer, and our provider policy is...to lock such server if it's under attack. Yes, we know it's crazy, it's like they're actually helping the attacker by doing that (when such server is locked, we can't do a thing on it as well).
The problem is, that they've said they're gonna take off the lock in few hours, but they didn't do it till now. Even if they stated so in tech support request message.
So we're still waiting...