Nmap shows port 21 is open with no ftp daemon installed.

[Rod James Bio <rjubio@gmail.com>]

Hi, I've been wondering about my friends case. Seems that when he 
nmapped his machine port 21 is open, but there is no ftp daemon 
installed. He tried
"lsof -i :21"
but it did not return anything. He also tried
"netstat -an | grep 21"
also nothing.
So he asked other people and they told him that his machine was hacked. 
The lsof and netstat was modified. The port 21 was a backdoor placed by 
the hacker. Now I am not really contented with this answers. Any 
suggestions?

--Rod James