[RLG_RLG]

Inside job is usually the answer for targeted attacks against inside systems. Inside collusion at a minimum.

I wonder how anyone can trust their linode systems after an admin account being compromised.

It would likely ruin their business to re-install everything, but that is the only way to know root kits have not been installed.

[lawnchair_larry]

Or just check if your instance was restarted and your root password was changed. If it wasn't, you were not exploited this way.