Sounds very spooky, but which console ...
pep@montblanc:~> last pep pts/1 Sun Feb 2 20:02 still logged in pep pts/0 Sun Feb 2 20:00 still logged in P***(*** ****P***h*** ********P******* Thu Jan 1 01:00 gone - no logout pep pts/2 Sat Feb 1 23:43 - 23:44 (00:00) pep pts/2 Sat Feb 1 23:35 - 23:37 (00:01) pep pts/1 Sat Feb 1 23:34 - 23:44 (00:10) si mon pts/0 pooladsl-a-25-7. Sat Feb 1 22:55 - 01:14 (02:19) camio pts/0 Sat Feb 1 20:59 - 21:55 (00:55) P***h*** ****P***(*** ***** Thu Jan 1 01:00 gone - no logout
pts/x means from remote via ssh. plz be more precise. Is he/she in your /etc/passwd ??? better make a lastlog>out.txt and a http://www.chkrootkit.org/ or a http://www.rwth-aachen.de/security/s30.html (sorry this is in german) !!! Philippe