[sudoaptinstall]

Thanks for the suggestions.

It appears that the individual is using their phone to log into the company email, so there's no trail coming from the school routers or email account.

I hadn't thought about trying to trigger the reset notifications. I'll look into that.

We have a few people in mind, but with no actual proof the school is afraid of taking steps due to litigation based on "unfounded accusations".