Sorry if this is irrelevant - but if there is suspicion of a hacked client, then staff can always see edit history.