Something seems off
That phrase about logging in 600 times in one day does not seem possible, the remote tool would have to be logging them out basicly immediately for that to even be phisically possible and they would not have any time left to be doing anything. It seems more likely 600 times the credentials were logged as checked or used over a much smaller number of sessions.
Biting the hand that feeds IT
