[Ozzie_osman]

Or at the very least, audit logs so they can see what that support engineer's account did during the period that the account was compromised.