They're caught up in the moment, I'm guessing. My first reaction was "where are the logs? show me some kind of actual proof". Otherwise this is just some kid who's paranoid and has a rootkit on his machine or something.