Mmm yes, there were lots of ideas as to the problem. It was kind of left hanging.

Personally, I suspect the router was compromised to allow remote management.

I hope he got it sorted out though.