The observations listed (high number of login attempts from foreign IPs, access requests for unusual files, and command history that includes reconnaissance tools) are classic signs of a previously compromised system. The reconnaissance tools found in the command history, in particular, indicate that an unauthorized party may have been probing the system for vulnerabilities, which is not a usual activity for a regular user or admin. Regular login attempts can occur but seeing them frequently from foreign IP addresses increases the chance of them being malicious. Access to unusual files suggests that someone might have been looking for sensitive data or trying to escalate their privileges.