Suspected person has admin rights and is computer wiz. They are making a copy of clients and then changing the accounts back when they are done doing whatever.