I'm a bit astonished that LinkedIn's IT[0] needed the FBI to figure out that the person had a unique useragent. And that they don't have alerts for unknown IPs SSH'ing into their server.

[0] though this is before Microsoft acquiring them, so it was probably just the usual startup reckless abandon.