2
He possibly replaced the cache/adminmenu.php file. You can delete it, then access the admin section again. You'll see "this is the first time you enter the admin"...etc. When you press the submit button a new adminmenu.php file is generated.
Hopefully that's all they've done.