many times a remote access program can come in from another port and access the machine without the local user even knowing it. a hidden user is created in advance and the rest is done incognito. If the remote user has admin privs then they can monitor "all" user activity through logs or even "watch" live operation.