Maybe it's a compromised sshd that dropped him in after printing the "Login incorrect".