By logged in you meant you could type and run commands? If yes, so someone else has the password cause NO ONE except the DO staff can login via the console. Try changing the password and start investigate the login and command execution history using history and last commands.