If you want to explore that avenue you should review system and daemon logs, user shell history and verify integrity and purpose of any file system contents.

================================================

1 ) where can i see the user shell history ?

2 ) which daemon logs should i be looking at , and where can i find them ?