Roxy fileman creates unknown_user directory

I'm working on a starter app and have a few users trialling it out. I assembled it in Laravel 5.4, its a simple blogging and email tool for users that can write articles and email their subscribers.

I've had a few "fake users" but nothing majorly malicious mess with the site so far however, quite recently I'm noticing a folder appear in my uploads directory (where other users folders are stored with an id, ie usr123).

I keep seeing this folder appear called "unknown_user", I noticed it had malicious images with .php.jpg extension within it the first time so I deleted it. Now it just appears as an empty directory within my fileman uploads folder.

I keep deleting it, Its not relative to active existing users but it keeps coming back.

I've checked everywhere in the app and can't figure out how this is happening and can't find anything when searching online.

There are no frontend entry points either. any ideas?

via Chebli Mohamed