move user to nologin mode in /etc/passwd /etc/shadow /etc/groups!
grep utmp/wtmp user logging/command issue from utmp/wtmp accounting logs!
add user to ssh deny list
revert back in forum!

man vipw
man vigr