HostBill Creating cPanel accounts with /home Home root?

[Vernard]

So today I noticed that my HostBill was creating cPanel accounts with /home assigned.

Any ideas as to why? I was hacked, I immediately deleted all the symlinks that the hacker setup using their cPanel account then then terminated it.

[Vernard]

Looks like one of my packages had "Shell Access" enabled, which created the cPanels with "Normal" shell which gave the user access to the entire server. 

[tallship]

ew. not fun.