I'm guessing that too, specially because the FATs were destroyed in an attempt to conceal the origin of the attack.
The Admins said they had revoked root access from the alleged suspect before the hack but there's no telling what he might have done before that, such as inserting a Trojan in the system that would allow full access after he got banned.
PS: "...after he got 'darted'?" I wrote after he got ban*ed, but it shows darted? lol.
_________________________
©2010-oo All Your rights belong to Me
By reading this You acknowledge that Your body and soul, including all your worldly possessions, are now property of this poster. Any unauthorized use of them will be punished.