if you are running sshd on port 22 this will show you all connections going into it

    sudo lsof -i :22

you can then reverse what people are doing based on the pids lsof gives you.

[edit: using ps ax | grep sshd also works but you can't see where they are connecting from. [+1 daten]]

The sshd process for your connection is still present on the server and looks like: "sshd: username@notty". You can find it easily with a grep of running processes.

ps aux | grep sshd.*notty