They got SSH access? Steps I would take are:

1. Isolate the machine.

2. Rotate your keys.

3. Set up ssh via ssh keys and remove ssh passwords.

4. Now do whatever you want with the isolated machine.

If you already are using ssh via ssh keys then either one of your employees has been hacked or "the call is coming from inside the house".

I would really suggest, as others have, trying to get the mysterious individual to tell you how they did what they did.