It's in the history printouts.

Look at the output of the history command, though it's not his command history, as he's logging in as someone else. (Looks like he's logging in as 'root' or 'backdoor', but I'm also not sure what the `-n` flag on `login` is; I don't see it in the manpages for `login` on OSX or Ubuntu)

You won't see it in top, it doesn't use enough resources. :p