Well, a user on one of my servers used an incredibly easy to guess password, so, his account got taken over... ive gotten everything back, checked out everything on the server, made sure nothing was installed or tampered with, grabbed all the info i could on the guy from the logs.. but, im wondering since he created some accounts under that users info in cpanel, if cpanel keeps any logs, as to what users do in cpanel, as i would like all the information and logs i can retrive..
