Author here. It was a brute force attack on my root. I added an edit for clarification on the article. Basically I use another user for deployments and server

Author here. It was a brute force attack on my root. I added an edit for clarification on the article. Basically I use another user for deployments and server work that has a pub key and didn't remove root login permissions.