Good news. No unauthorized access seems to have happened.
I have researched the specific warning you received.
It comes from ProFTPD, in the module mod_auth, the source code can be found here.
What interests us is this:
/* Next function (the biggie) handles all authentication, setting
* up chroot() jail, etc.
static int setup_env(pool *p, cmd_rec *cmd, ...
Detecting security events needs some previous steps as the logs concentration in a unique point.
Then, you can plug a SIEM onto this concentrator to match suspects pattern.
With a configuration like this, when an intruder get into your server, the logs are sent in real time to the concentrator. So, even if he can remove the local logs, you still have the ...