You may have been lucky, but that was not the case with everyone. Some of the entries appear to be missing, but last night someone setup a honeypot and was posting what they saw.

Adding keys to /root/.ssh/authorized_keys, scp'ing sshkeys, flushing iptables.

I am of course one of the idiots that had it exposed to the internet. I wouldn't do it with a database, but I didn't think twice about salt. Where was my head!