hosts.allow insertion does sound somewhat odd... If you fully manage the server though, the hosting provider shouldn't be adding anything in there unless it's to help troubleshoot an issue you're having. Anything beyond that should be documented to you so you know why it was done.
If something like this occured on my server, I would install file change monitoring software to see how it was occuring.
I've been troubleshooting the fact that my ipchains or iptables won't work and I've personally and manually added over 5000 IPs to my routing table but the incoming connections to sendmail are still coming strong. I'm using mail/access to discard but the quantity is such that my maillog shows deferring constantly. Haven't crashed in 4 days tho.
I will lookup file change monitoring software, thank you.
I'm deciding what to do next. I hired someone to come in and setup ipchains to stop this incoming mail problem but it was found that ipchains and iptables won't work.
Redhat is not compatible with the kernel, Ensim needs an upgrade, and the server is too fast for the harddrive. Of course the provider wants to charge me to fix it all even though I couldn't have possibly told them to spec out my machine in such a way.