[cobalt-users] Weird admin/root password problem (hacked?)

[AHA Lists <lists@xxxxxxxxxxxx>]

The other day I was logged into one of our servers (raq3) via ssh as root
and was backing up and editing some log files.  I logged out and a few
minutes later I had to log back in.  I couldn't.  I got a password error.
About 30 minutes later when I go the password reset I looked all over the
box for anything weird.  I looked through the log files, the logins, the
bash files and didn't see anything out of the ordinary.  I ran chkrootkit
and came up with nothing.

I couldn't get into the box for 30 minutes and like I said I didn't notice
anything odd on the box once I got back in.  Any one have this happen before
where their password didn't work and it wasn't the result of a hacker?