It looks like he knew it was on based on the timestamps of the messages and his connections/disconnections.