Specifically, they had Teamviewer codes everyone knew or had access to and never rolled them over time. The control panels were just left open on the consoles of the computers. Someone saw the mouse moving on the screen which, along with the settings changes, alerted them to remote access. Scary stuff.