This post is over 3 years old, so please keep in mind that some of its content might not be relevant anymore.
If you have logwatch installed (or you read auth.log file) you can find lots of entries mentioning login attempts/attacks.
Something like:
Nov 20[......]