If what you are saying is true then, make sure to check that everyone that is working on your game doesn’t have a malicious plugin disguised as the real thing. I suspect that maybe someone has used a malicious plugin disguised as the real thing by accident, and it inserted a script into the hidden parts of studio.
Enable these and check to see if there are any scripts anywhere.
Make sure to first check the CSGDictionaryService as it can be a primary target of these sorts of things.