wpdbg

Oh, the reason I am suspicious that it is The Events Calendar doing it is that running ‘strings’ on the huge tempfiles invariably reveals that they contain chunks of templates/code from The Events Calendar, and/or JSON data related to it.