@laliz Sucuri is not a server side scanner. Even their free plugin is not a server side scanner. Only a server scan is capable of locating all types malware. And even though a scan may be capable of finding malware, there is no guarantee it will. This case is a perfect example, Wordfence is an excellent tool but it didn't find malware.
It is not prudent to tell a site owner their site is not hacked unless you can verify that. Hacks appear and disappear. They only show to some agents or OS or browsers.