I think someone compromised the machine through some other method like brute-forcing the password, and then doctored the transcript.
Nevertheless, I've played it safe and firewalled off SSH on all my Internet-facing machines except from friendly IPs. I guess we'll see in the next few days...