root user / in.proftpd command displayed in top

[ssiAdmin]

When logged in as root and running top, I see a number of processes running as root for in.proftpd. I believe this is for anonymous ftp (which we don't turn on).

My guess is an account has been compromised. Any thoughts or suggestions?
I know I am not running all these ftp connections.
Art