I think I may have figured out what was doing this: I had an app installed called FingerPrint, which is supposed to let you print from iOS to a non-AirPrint-compatible printer, but it never worked well for me. I had it set as a log-in item.
In system.log, there are tons of entries that say:
Jun 14 23:59:13 macintosh-2 com.apple.launchd[1] (com.collobos.fingerprintd[77594]): Exited with exit code: 1
Jun 14 23:59:13 macintosh-2 com.apple.launchd[1] (com.collobos.fingerprintd): Throttling respawn: Will start in 10 seconds
That's just an example. There are tons of this from this morning too. After deleting FingerPrint, I'm now seeing these entries:
Jun 16 08:20:11 macintosh-2 com.apple.launchd[1] (com.collobos.fingerprintd): Throttling respawn: Will start in 10 seconds
Jun 16 08:20:12 macintosh-2 WDDriveManagerStatusMenu[269]: *** attempt to pop an unknown autorelease pool (0x81d600)
Jun 16 08:20:21 macintosh-2 com.apple.launchd[1] (com.collobos.fingerprintd[3805]): posix_spawn("/Applications/FingerPrint.app/Contents/MacOS/fingerprintd", ...): No such file or directory
Jun 16 08:20:21 macintosh-2 com.apple.launchd[1] (com.collobos.fingerprintd[3805]): Exited with exit code: 1
Jun 16 08:20:21 macintosh-2 com.apple.launchd[1] (com.collobos.fingerprintd): Throttling respawn: Will start in 10 seconds
Is it possible that all these instances of com.collobos.fingerprintd trying to respawn the app caused multiple user connections?
Before I deleted FingerPrint, Sys Prefs was saying that 2 users were connected. Now it's just saying one.
RE the "who" command in Terminal: It produces this:
[user name] console Jun 15 18:15
[user name] ttys000 Jun 16 07:59
Both user names are me. Not sure if "console" and "ttys000" are meaningful.
Also, both system.log and kernel.log have tons of entries in them. Not sure what I should be looking for. Filtering out anything that says "en0" produces nothing in system.log. In kernel.log, I get one entry per day that looks like this:
Jun 16 07:00:07 macintosh-2 kernel[0]: Ethernet [AppleYukon2]: Link up on en0, 100-Megabit, Full-duplex, No flow-control, Debug [796d,6d00,0de1,0200,41e1,4000]
I have the iMac set to wake up at 7 AM every day, so I assume that's from the wake-up process.
One last thing: I do use FaceBook and LinkedIn. I use FaceBook on both the iMac and MacBook and LinkedIn only on the MacBook. Could an unauthorized user gain access through one of those?
Thanks for all your help. It's much appreciated.