Why whoami always returning "root"?

After a hack, a dedicated server always return "root" following whoami command. Even after a sudo su myUser > whoami return "root". myUser exists on the server, because regarding this issue passwd myUser return Changing password for myUser. Furthermore, when installing package on the server, rights are always set as root:myUser. What are the paths, that could lead to a whoami always returning 'root' ?