Well, from what i read he was using "pc-anywhere" to control the remote pc and he was caught because some one was walking past the computer and saw the mouse moving all over the screen.
So maybe they had wordpad open and where able to see what each other typed?