Nobody else is concerned that this person was able to ssh to the server without firewall rules blocking him?
Sounds like the only reason anyone even knew what was going on was due to the entire server being down and a bunch of wallets being offline.
The provider, as most providers do, allowed booting into "recovery mode." They did this first via support tickets, then got on the phone to get the password reset. Ordinarily, firewalls are up at all times on all servers.
So you are confirming that there are no network level protections in place? You are relying solely on the host firewall? Or did the provider also bring down the network level firewall for this user?