Seems likely (to me) that he was probably using his company laptop and it was connected to the corp VPN most of the time.