Some nasty computer can see that there's a web port open and is trying to install PHP or other scripts. Do this customer have a webshop? If not, try changing the web port. Or even block it on the firewall for the moment, although be aware that client autoupdates from outside the LAN require it.