Can you configure your Firewall to log ALL inbound and outbound activity from this user (or IP)?
Forum Rules