He's on red now, but his eventlogs do show a bit of suspicious activity.