Was it actually the provider scanning, or just a compromised VPS host using that same provider?

It does seem proactive to scan customers' hosts then notify them if exploits are found.