Focusing on cloning a MAC is a red herring, which we've unfortunately been pushed into from having to continually rebut this persistent nonsensical idea that it's some kind of fixed identifier.

The more likely scenario is a straightforward remote-access trojan installed by a housemate. Every other detail then falls out socially.

Ultimately, prosecution of computer tampering continues to reek of "burn the witch!". With emotionally charged terms simultaneously used to focus blame by ascribing superpowers to the defendant, while deflecting any competing theories as too complex for anyone but the witch.