ok let me re-cap for you.
1. I rest his login using ISO boot CD Trinity rescue Kit , which allows you to remove any password and unlock the account
So I could login using his admin account , NO Password required
2. You ask to show what would happen ,
So I changed his password , and added the password Hint back in that I had written down
3. How often
As original stated , he had issues about 1 month ago , which I thought I had resolved.
He then came to me the other day to say the same thing had happened.
There maybe things he is not telling me out of shame.
What I suspect is that someone is possible phoning him up and he is giving them his IP address then they somehow connect to his laptop.
However I dont know for sure.
He is a elderly neighbor but I can not start to integrate him , it is not the done thing.
Apart from running EEST is there anything else I should be doing.
Or just give him his laptop back and try and tell him not to allow it happen again.