Why wasn't there a PAM solution in place that logged all the mainframe user level activities and commands? Maybe cyberark or such? Would have help to trace the issues and even control such commands from being run by a novice.