Check these lists against the current directories. After a while you will be able to spot unusual changes, and it is much easier to spot anything that was added. They are in and out, logs cleaned up and all in a just a few minutes. Now they have a legit user account with root privileges. They can do what they like and you will be none the wiser.
Most people think that when they get hacked the system crashes.
Far from it. The good ones come and go unseen. That is the danger, since everything is working no one is looking for anything. A firewall is not enough. A firewall only tries to keep them out by plugging the holes.