It’s been maybe a month since I shut down IIS. The files show when they were last amended on the server, but I can’t be sure if that was me or not.

I removed the standard windows FTP in favour of FileZilla. I will check to see if there is an IP log on there.

I will also see if the server keeps a log of everyone who has accessed it (it must do).

In the mean time I’ve changed all passwords.