That's what I figured.

For an organization dedicated almost entirely to computer systems, though, you'd think it would make sense to track system misusage incidents with... a computer system. At least if you want to be efficient.