look for users unknown to you. Run a sanity check on login su rc.2 scripts check for an extra modem(was at a place and found one) with dialin abilities. Runa port scanner after he is gone to see if only the holes you expect to see are there. take a look at the process stack for unknown daemons.
thanx,
bill