Quote Originally Posted by morganlefay View Post
He is not on our internal network but shares our internet and every so often he fires up some program that creates the log entries.......as stated he claims its his IMAP client and I call bulsh1t.

Thats the gist of the thread.

MLF
Haven't kept myself up2date with the entire thread, so if something below is already mentioned then please don't hate on me.

Is it possible that next time he comes in, that he's laptop/device get's checked out?

ie set up a "Closed environment" and have a scan of the "Network" activity that tries to establish a connection, have process explorer up and running and keep an eye on processes that launch etc etc.

in the current logs you have how big are the intervals? are they every 5mins or shorter?