Legitimate user or hacker -Terminal?
All users account starting with an _ are automatically generated by the system. For example, _lp is an account used to manage the Printing Services without the use of the priviledged account root.
This is a separation of priviledges and a good protection.

For all other account names,
daemon and nobody are also generated by the system.

For the remaining accounts, let's say you see a suspect user account bond, use the following command:

finger bond


to check what bond account is used for and when it was last used to connect on your system.