Hmm... Its possible. I found this note on a posting on a Cisco site: "Note: When the tftp-server command and the filename are defined, every time the write net command is issued, the current configuration file is always overwritten.
That would hint that maybe it does that. I've never used the command personally. The copy commands work just fine on ASA's too I believe...
I've tried playing with the command, but don't see it doing that - but the behavior might be IOS specific...
Here is a thought, are you using a TACACS server? If so, maybe configure up command accounting so you know exactly what is going on? Something like
aaa accounting command privilege 15 AAAServerGroup
You might have to do it for level 1 and any other levels you might have defined. That way it will log what commands are being issued on the ACS/TACACS server and you can see what is coming from where?
If you aren't using one, maybe try a freebie one like TACACS.net to find out?