but i installed ffp, could it be a source of issues?
Might well be. I observed the same on my ffp 0.7.
First, log in with telnet (you'll need to re-enable it if you did disable telnet after setting up ssh).
Then run pwck and grpck from the command line. I suspect you have new entries for the root account in your shadow file.
Also check your /usr/local/config directory. Do you see strange scripts with recent creation date? What are they?
I blocked all http and ssh access to my NAS from outside network and only log in via VPN to my home net. I also deleted all those weird scripts and folders and since then it has been quiet.