Thanks for the answers so far. So
NOQUEUE: [22.214.171.124] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
is nothing to worry about. However I'm very worried about the
PAM-warn: user: (uid=0) -> admin [remote: ?nobody@?nowhere]
messages. It looks to me as if someone already has gained root rights and made an su to "admin" (which should be impossible, because /etc/passwd as I see it doesn't contain that user). I hope to be misleaded...
Best regards, Matthias