I find it somewhat entertaining, since it’s almost exactly what I went through investigating a very similar situation several (probably nine) years ago, on my friend’s server. I actually ended up talking to the attacker in his IRC channel, and he was nice enough to tell me how he broke in. Those were the good old days…