If you think you've been hacked, I strongly recommend How do I deal with a compromised server? .
Otherwise, check root's
.bash_history, looking for things like output redirection onto
/etc/passwd. If you use
sudo to control root access, check the sudo logs around the time (the modification time on the file will tell you when it was zeroed out, most likely).
And, for goodness' sake, get off Red Hat 5.7. You're running an OS that's nearly a year's worth of patches out-of-date, and there's no sane reason to. Red Hat's patching policy is that no version of any package is ever bumped inside a major version of the OS; patches are backported instead. The whole point of this is that you should be able to keep your RHEL5 constantly in patch without endangering any functionality.
In many ways, there isn't even any such thing as "Red Hat 5.7"; RHEL 5.7 isn't really an OS release version, it's simply a line drawn through the current state of patch of RHEL5 on 12/3/2012. When you say "I'm running RHEL 5.7" what you're really saying is "I'm running RHEL 5 and I'm a year out of date".