Comment by romwell

As my understanding was that the auto-reboot and lockdown of the systems supported by this engineer were the cause of this, the attacker scenario yields to Hanlon's razor here.