It turns out virtually all VNC and Remote Desktop options were on and the Firewall was allowing them through. They're all turned off now.

They said when the mouse moved it moved really quickly and didn't appear to have any pattern when opening and closing windows from the start menu - so it sounds something more scripted or automated than someone controlling it manually.

Will get them to use the other tools suggested since I replied yesterday and reset the user names and password.

Oh yes, they bought the computer second hand. And no, I didn't even bother to ask if they reformatted it completely - I already know the answer to that one :-)

Cheers,
Niggles