Issues may change depending on release. In any of the earlier releases there would be both an “ubuntu” account and an “nvidia” account, along with a password which is the same as the name. In later releases you have to create an account on first boot. If this was an earlier release and you didn’t change the password to the “ubuntu” account, and if this was accessible on an unprotected network, then someone probably got in and edited something.
Meanwhile, do you have a serial console? This is always logged in. If you lost the password you couldn’t use sudo with it, but you might be able to gather information or see more about what’s going on. If you connect the micro-B USB cable to the Xavier, and then the full-sized type-A connector to your host (monitor “dmesg --follow” prior to cable insert), then one of the serial UART ports will be able to work as a login shell (settings 115200 8N1). I’ve arranged my Fedora host differently, and so the actual port will differ for you, but if you were to use gtkterm (“sudo apt-get install gtkterm”), then it would be something like this:
gtkterm -b 8 -t 1 -s 115200 /dev/serial/by-id/usb-FTDI_Quad_RS232-HS-if03-port0