Thanks for your help, I think he got the root, before he used the SSH. But, as he has access to the root I can not explain.