Look at the output of the history command, though it's not his command history, as he's logging in as someone else. (Looks like he's logging in as 'root' or 'backdoor', but I'm also not sure what the `-n` flag on `login` is; I don't see it in the manpages for `login` on OSX or Ubuntu)

It's in the history printouts.

You won't see it in top, it doesn't use enough resources. :p