I was contacted by a guy who said he found a vulnerability on my site. Something like phpinfo being available or something. I informed them that I was aware of it and it's not a vulnerability but did offer to give them a small Amazon gift code if they wanted.

This might be part of the motivation. What's pocket change in the west might be good money in the 3rd world.