>Are you saying that the two sessions were NEVER active at the same time and one of the sessions was always done via terminal server? The other concern is "inside intel from other people" which I find impossible to believe. If he were actually doing this, why on earth would he inform someone else and risk exposure? I find the "other people" somewhat suspect.

If you have two accounts on the site, you can access them from the same PC if you use two browsers.The fact that I have identified two IPs doesn't mean exactly that it was the same PC. It could be from one local connection and a remote one. Or, simply using two PC having access to the Internet from two different DNS and network sitting next to each other. I doubt the second one. The first one is probably the easiest one to use to fake all this. But, IAC, this is not a factor in here. Yes, a very high precise pattern was done between both accounts switching back and forth. Note that one browser can still hit the server when the other browser hits the server from manual requests. As there is an auto refresh interval that is always going on. What I am talking about is that manual hits were done from two sessions opened at the same time with those two accounts in an alternative way.

Now, that members know about it, if we still have troubleshooters on board, knowing that we analyze that as well, they might know some additional information as to hide more their againts the rules behavior on the site. So, I will not elaborate too much on the way of identifying someone. There are other ways as well. But, if we want to keep the site clean, certain information has to remain private. I do not recall Facebook administration or Zuckerberg going online telling how they find troublemakers and shut them down. I just try to be politically correct and answer most of the requests here but this is something I do not have to do.