According to the gateway-core-ipn.log
this was a subscriber cancellation from PayPal:
LOG ENTRY: Fri Apr 7th, 2017 @ precisely 4:45 pm UTC
PHP v5.6.30-0+deb8u1 :: WordPress v4.7.3 :: s2Member v170221 :: s2Member Pro v170221
Memory 16.10 MB :: Real Memory 17.00 MB :: Peak Memory 19.79 MB :: Real Peak Memory 20.75 MB
www.semantica-portuguese.com/?s2member_paypal_notify=1
User-Agent: s2Member v170221; https://www.semantica-portuguese.com
Array
(
[txn_type] => subscr_cancel
[subscr_id] => RP0000003179
[custom] => www.semantica-portuguese.com
[period1] => 1 D
[period3] => 6 M
[payer_email] => jameshall-6-month-4@semantica-portuguese.com
[first_name] => james
[last_name] => hall
[option_name1] => Originating Domain
[option_selection1] => www.semantica-portuguese.com
[option_name2] => Customer IP Address
[option_selection2] => 68.0.140.45
[item_number] => 1:freetrial
[item_name] => 1 Day free / then FULL access for 6 months
[proxy_verified] => paypal
[s2member_log] => Array
(
[0] => IPN received on: Fri Apr 7, 2017 4:45:46 pm UTC
[1] => s2Member POST vars verified with a Proxy Key
[2] => s2Member originating domain (`$_SERVER["HTTP_HOST"]`) validated.
[3] => s2Member `txn_type` identified as ( `subscr_cancel|recurring_payment_profile_cancel|mp_cancel` ).
[4] => Auto-EOT Time for this account: Fri Apr 7, 2017 4:22 pm UTC
[5] => Cancellation Notification Emails have been processed.
)
[subscr_gateway] => paypal
[subscr_baid] => RP0000003179
[subscr_cid] => RP0000003179
[ccaps] => freetrial
[level] => 1
[ip] => 68.0.140.45
[s2member_paypal_proxy] => paypal
[s2member_paypal_proxy_use] => pro-emails
[s2member_paypal_proxy_verification] => df906692b147b9a90850466e8d880e04
)
You have a LOT of cancellations in that log. I only saw 1 that was due to payment failure, but that was not a thorough cross-check of the logs, just a quick look.
s2Member demoted the User because PayPal sent a transaction saying the User had canceled.
I did cross-check 3 users between gateway-core-ipn
and auto-eot-system
and, for those 3, each EOT action had a corresponding cancellation transaction from PayPal. PayPal is sending cancellation transactions and s2Member is processing them. If your Users are not canceling at PayPal then you need to find out why PayPal is sending those transactions. I think it highly unlikely that s2Member is creating these log entries out of thin air nor do I think this is caused by any kind of theme/plugin conflict.