DISP=SHR allows writing as well as reading the data . . .
I am frankly clueless on what could have happened as the customer has clearly told he didn't touch it
Well, someone/something did
Sounds like there may be a process the client uses(ed) that Does re-write things. Is the user able to restore prior files?
Is there any chance there was some kind of system problem that resulted in these datasets being restored (say an entire volume) so there might be no individual SMF footprints? Have you talked with your storage management people?