The same happened to us when someone added a user 'test123' with the password 'test', just to… test something locally, totally forgetting that it would also permit access via ssh.