How could this account have been cracked?

Hi,

I'm a longtime Linux admin, and I'm really puzzled by some unauthorized
use I just found:

I personally created an account with a somewhat uncommon spelling of a
name. I told no one about this account. I personally only once logged
into it from the console in my private office running KDE in order to
test it. It's possible I gave it a weak password. (I've since
forgotten it.)

Only seven days later, "last" shows someone ssh'ing into the account.
Inspection shows that this person really knew what they were doing -
attempting to install a rootkit, setting up a spam process, etc.

I have no idea how the existence of this account was detected.

Thanks for any possible ideas!

.