Appear to be e-mail client related, has there e-mail client to check for new mail every 1 -> 2 minutes

i imagine being a mac he has that push to device enabled.

personally i would "Sandbox" the machine into a controlled environment, if it has wireless device, then let it connect to a fake hotspot and run a air-scanner to monitor the in-bound outbound traffic.

are you able to have some physical access to the mac next time he comes by?

If it was p2p there would be more "Data" logged especially if you have ports blocked, no port forwarding etc.