sudo grep 'Accepted publickey' /var/log/auth.log | tail -10

Every successful key-based SSH login writes an Accepted publickey line to auth.log; this shows the ten most recent, with user, source IP, and key fingerprint. It is the audit trail for 'who actually logged in' — compare it with your expectations after an incident. For password logins, grep Accepted password instead.