I found something in process
xxx 15174 0.0 0.0 115408 1456 ? S 02:41 0:00 sh -c /bin/nice -n 19 /usr/bin/zip -ry /home/tmp/xxx.zipOyznB7 domains > /dev/null
xxx 15175 36.9 0.1 179268 69300 ? DN 02:41 2:05 /usr/bin/zip -ry /home/tmp/xxx.zipOyznB7 domains
don't you think about this: /home/tmp/xxx.zipOyznB7
it should be /home/xxx/tmp
as every user have tmp folder inside his directory