Root was logged into whostmgrd using following authentication service: system
 

What does that mean? Is that a login from cpanel or whm? Also is there a log of all users that have logged into whm and/or cpanel?

Thank you for posting this information!)