Just found out,
1) the comment for abnormal trade is 'TOMs' EA 1.96', the comments for the normal trade iss 'TOM's EA 1.96',
2) the magic code for the abnormal trade: no any magic code, that means this abnormal trade should be placed by manually or by some program, not by TOM's EA as usually?
the question is why some one login in my MT4 on VPS to place the abnormal trades by using the very closed comment to TOM's EA1.96'
I think this problem should be not from TOMs EA, but from VPS sides.
Always Risk Management First, Then Grow The Profit!