The good the bad and the ugly. Depending on which account they logged into, all they would need to do (say as root) is run a packet capture to see anything else on the network. Imagine the following for a moment. You are in a room (network), other people are in the same room (virtualization), and you place a tap recorder to record everything (sniffer).
Its already been mentioned to find hardening documentation, my suggestion differs a bit. Learn firewalling ;) Because your Linux device has its own firewalls, now is a good time to familiarize yourself with creating rules. "Block anything from this address, to my address, on this port." Obviously, shut down services you don't need, and keep things separated password wise. For example, if your normal password is bastek1234 for say your Windows machine, I don't suggest you re-use passwords.
You exposed your machine to the world, so expect garbage to hit you. Now is also a good time to play with cron, and scripting languages. For example, write your own alerting system:
tail -n 1000 /var/log/auth | grep -i failure | mail -s "Failed Attempts" email@example.com
There are plenty of mechanisms you can take the initiative on once you have an idea of what you need to do. Don't always rely on "hardening" guides as those change. I have written hardening guides dating back to 1996 to which I chuckle now at how much things have changed.
As for busting out of VMWare, there is Cloudburst ;) http://www.google.com/search?q=cloudburst+immunity+%2Bcanvas&oe=utf-8&rls=org.mozilla%3Aen-US%3Aofficial&client=firefox-a&oq=cloudburst+immunity+%2Bcanvas&gs_l=heirloom-serp.3...10278.11859.0.11918.104.22.168.22.214.171.124.454.0j3.3.0....0...1ac.1.24.heirloom-serp..6.2.310.yifcckJx4gU
You don't need to log in as root ever. That is what sudo is for. And if sudo isn't enough, you could slap on Duosecurity to ONLY allow commands after it has called your mobile/landline to validate you are who you say you are. As for logins, you may parse through your .*_history files to see what was done provided they didn't erase the logs