Not my call either
What we do is not complex
IP tracking and IP matching via tunnels, we then match up with FunnyB
We also run VPN logs if he has any via his ISP
It is all easy to do with hidden spiders and hidden proxy back end shells
If everything matches he is clean, there is nothing to see here
I had to post because of the new Audit laws