meemaw There is a chance that Duress pin/password was accidently setup.
meemaw Is there a way to access file system via adb/fastboot and try to see whether something is left using the password to decrypt storage?
If the duress PIN/password was used, then no, it wouldn't be possible to get any data off of the phone.
meemaw Strange thing is, that this pin was used few times to unlock the phone so i don't get why it suddenly was wiped.
Here's a quote from the section about the duress PIN on the website:
Note that if the duress PIN/Password is the same as the actual unlock method, the actual unlock method always takes precedence, and therefore no wipe will occur.
So, if the real PIN and the duress PIN were the same, then the profile's PIN was changed and then someone later used the old/duress PIN, the phone would be wiped.