>>>OK, so you're saying explicit or implicit logoffs didn't always occur. It looks like you're looking for evidence of "simultaneous" activity, the idea being if such is found, they must be different people. Simultaneous activity could be things like:
>>>
>>>- hits from the 2 different IPs/accounts within a very short time period (e.g. a few seconds)
>>>- interleaved hits over some reasonable time period i.e. not just from one account or the other
>>>
>>>But, if I'm correctly interpreting what you've been saying so far, you have seen neither of the above for Kevin and "Grover", so you believe it is one person, first paying attention to one account, then to the other.
>>>
>>>IMO that's a reasonable interpretation. However, I agree with Tracey - I think it would be a good idea to run your analysis for "Grover" vs. other active members, and also for Kevin vs. other active members. If any of those analyses raise the same flags, then the behaviour may not be unique, or your analysis algorithm may be flawed (or both).
>>
>>If there would be a third person involved, than this would be worst as it would mean that three persons decided to prepare a scenario to cause trouble at a precised time frame. If there is a third one, I haven't found it yet.
>
>I did not mean to check for a third person involved. You've checked interaction between Kevin and "Grover". I meant to check for interaction between "Grover" and active users other than Kevin, and between Kevin and active users other than "Grover".

That, as well as checking for the same ip -- even though ip addresses can be spoofed -- was my point as well. Before merging accounts, I think it should be beyond a doubt that the same results do not show up for any other users. If it wasn't run against all other members, how can it definitely be Kevin? Otherwise, there is a flaw in the algorithm. Merging accounts is putting messages possibly not posted by Kevin under his name.