Support

Since this is the initial scan we can't make a very good guess. Most of what I see I recognise and know they are very likely legit. Keep running scans on a schedule, following the instructions in the documentation on how to read and use the scans. It will help a lot with spotting changes in files.

Now, about your issues in Joomla, do make use of Joomla's User Activity Log. Enable all plugins in the "actionlog" group and the “System - User Actions Log” plugin. This will keep a log of everything you or anyone else logged into the site is doing. If you spot something on the site being off, take a look at the activity log. I am pretty sure it's a change you forgot you made, or a change you made by accident. It happens to all of us.

Also ask the management company if they are the ones changing permissions — I think they do, possibly on a schedule. If the changed permissions are a problem for you they will need to modify the web server configuration.

Regarding phpMyAdmin, I very strongly advise protecting its folder with a username and a password. Ask the management company to do that for you. It will basically be a slight variation of what you see in https://www.ionos.com/digitalguide/server/configuration/password-protect-a-directory-with-apache/ for example. This will make sure that an attacker couldn't just use phpMyAdmin directly.