solved Default checks processing and emails

Good Evening,
someone tampered with gfi event manager.
Now i get the following emails every minute:
 
[GFI EventsManager] -  Default checks processing - Critical  -  Critical  -   localhost -  Disk space
Check name: Disk space
Check status: 0
Check message: User credentials cannot be used for local connections 
 
[GFI EventsManager] -  Default checks processing - Critical  -  Critical  -   localhost -  Physical disk condition
Check name: Physical disk condition
Check status: 0
Check message: User credentials cannot be used for local connections 
 
[GFI EventsManager] -  Default checks processing - Critical  -  Critical  -   localhost -  Physical disk condition
Check name: Physical disk condition
Check status: 0
Check message: User credentials cannot be used for local connections 
 
I'd like to know what gfi component is sending them, why, who did that.
solution:
It was in the monitoring checks at the generic node verification.
The mentioned checks were active only for localhost and were using wrong credentials.