Messages like these appear in the system log:
"Feb 15 01:01:00 savuud PAM_pwdb[1402]: (su) session opened for user news by (uid=0)"
"Feb 15 01:01:01 savuud PAM_pwdb[1402]: (su) session closed for user news"
A user called "news" exists in the password file, but you can't remember creating it.