user tracking

Hey guys.

    At login I get a printout of when the last login occured.  Where
is that info stored?  I want to check out a user on the system but
don't want to log in as them.  One of the machines I work with had the
root account compromised.  It's just running a few mushes so it's not that
big of deal but I don't want it happening again.  I went through it with a
fine tooth comb and wouldn't mind it if any of you guys tried to whack at
it...  Lemme know what you find.  The IP is 205.216.140.17

Don