I've checked the loginwindow.plist of my original install (the one that is still on my main machine not from timemachine) it doesn't mention anything about the changed login message. Which means it was changed sometime during/ immediately after the install.
As for the identity of the person who could have changed it. I really don't know anyone with the know how to do something like this remotley (or even directly to be honest).
There seems to be alot more information in my current install's com.apple.loginwindow.plist
I don't know if that is of any help.
Also I'm currently keeping an eye on all network activity through little snitch.
a few sevices make me curious
mDNSResponder: which seems to ping my phone from time to time.
Netbiosd: I have no idea what it does but it seems to be connecting to my girlfriends mac
as well as
sw_probed and ifffswiretapServer which seems to be from an old copy of autodesk smoke. (could this be used to hack my system?)