IF ... IF ... the hypoth is true, you should be able to see that 'behavior' in your servers access logs. Are you sure they are your users? mdl_user table does record lastip.
From cli: fgrep [alastipofauser] /var/log/httpd/ssl_access_log ... will show ... if logs are kept in that location.
'SoS', Ken
From cli: fgrep [alastipofauser] /var/log/httpd/ssl_access_log ... will show ... if logs are kept in that location.
'SoS', Ken