I guess may the compromised host was probably also use same weak password as it's Brute force other host.