There's also been a fairly feeble attempt at rooting the box; a user account with a weak password was compromised and two exploits were attempted - firstly a linking-to-.rhosts exploit, and secondly a gpm-root exploit.

chkrootkit came up clean and on the strength of that I've installed tripwire.

I will be reinstalling the box anyway as a matter of best practice.