This feels like a lifetime ago, but IIRC evidence of on-going exfil was apparently presented to users who were no longer working.