hint, console means you're logged in, and tty's are terminal windows.
but yeah, about the scariest thing about this new OS is the number of ways that one might get into the system, and the minimum of detection. Hell, I could tell if someone was connected to my machine in 9 by how fast it ran. Now, I've had people looking at gig's of movies and mp3's over the local net and I felt nothing. Nothing.
GraNet will graph network usage, that's a start in detection. I lovi little bliny light applications like thermoInDock, GraNet, and the CPU-Monitor. I like my hub sitting on my desk so I can see the traffic. Not everyone is like me, but I agree, it's hard to tell who's on the system.