If this was issued from OS, then do

last | more

at OS prompt

You can see what was logged on from what IP address at what time.

That might help to narrow it down some.