This reminds me of a story of a little boy who lived in a house on the edge of the matrix. Forgive the 2050's-era Universal Matrix Specification iconography in the following, but the core of the lesson still holds true.
QUOTE (Virtual Realities <Shadowrun First Edition Sourcebook>)
CODE
You put your hand to the edge of the tube, and though it seems nothing is there, it is as though you had touched a barrier. Your hand can go no further. There is nothing there, but it is a solid nothing.
As you travel down the data stream, Lucifer is beside you, leaning back, legs crossed, as though sitting comfortably in an invisible chair. You ask him, "Why can't I put my hand outside the data stream?"
"Because there's nothing there."
"I know. That's why I don't understand why I can't put my hand through it."
"No, no, my chummer of a pupil, you can't get your hand outside the stream because there's nothing to put your hand into. In the Matrix, empty space isn't a void. It's nothing. It doesn't exist. At all. Remember that everything that you can see or touch in the Matrix only exists to interact with something else in the Matrix."
While I agree with what's been said earlier in the thread, that you typically have to be logged into a node to use Matrix Perception to detect the icons of other users in that node, in the end, it comes down to how the users of a node decide to set that node up to interact with the rest of the Matrix. You stated that the target was a corporation's public node. What is the purpose of that public node? Is it simply a place for them to display advertising for their particular product, or are they using the node to facilitate a virtual community among their customer base? Imagine Dumpshock as a public node.
Without even logging into Dumpshock, I can get a listing of board statistics, including which users have logged in in the past 15 minutes, and each name is a clickable link to a profile. From the "Public Account" however, my access to these "icons" of user-level accounts is highly limited. I can perceive certain aspects of them, but that's about it. When I do log in, with my own user-level account, the rights granted to that type of account open up my options: I can send Private Messages to any of those other icons, and I can edit files (board posts) that become visible from the node's public space. I still can't see another user's AccessID though, since that function has been reserved for the moderators with their security-level accounts. All these things that I can and can't do from both the Public and User-Level accounts, are the consequence of choices that the users with Security and Admin level rights made in setting up the node.
So, if a bunch of vandals came along to Dumpshock, and hacked themselves some security-level Moderator accounts, they could perform vandalism that's easily visible from public space (deleting and editing other users's posts ) and make their icons visible while doing so, because that's how the node was set up to be used. A different public node, one set up to display files to the public account but not allow any interaction, would be more limited: vandals could edit the files that are in the public space, but they themselves wouldn't be visible.
This brings us to the issue of how the normal workflow of nodes and these levels of privileges get configured in the first place, and whether or not such things could be changed on the fly. Presumably such a task would take Admin Level access, but the rules don't go into any sort of detail on this subject I'm afraid.