Inside job is usually the answer for targeted attacks against inside systems. Inside collusion at a minimum.

I wonder how anyone can trust their linode systems after an admin account being compromised.

It would likely ruin their business to re-install everything, but that is the only way to know root kits have not been installed.