Author here.

It was a brute force attack on my root. I added an edit for clarification on the article. Basically I use another user for deployments and server work that has a pub key and didn't remove root login permissions.

Yeah, unless you resolve that, it's just a matter of time before you get compromised again.