We had this kind of incidents reported before - that's why it's recommended you change the default password for the pi user. Unfortunately the best advice is to wipe clean the card and re-install the system.