After an obvious reinstall, consider using tripwire next time and monitor it. Tripwire will alert you to any file changes that occur, tipping you off that something is happening to your system before you have legal issues that you have to address.

The honeypot idea. Like it was said before it won't help you find out where they are attacking from. Also there can be some legal issues with setting one up to trap someone. It is much the same as entrapment by law enforcement. I will say I like honeypots but there has been a lot of legal controversy over this.