The Network: High tech provider of services
The Expectation: Users with IT admin skills are more careful than the average user
The Catch: Connections from the users workstation to external sites on non-standard ports; short duration but many connections to many countries observed in a few hours
The Find: User had installed video player at the encouragement of a peer. User had local administrator privileges to do so but was expected to be mindful of the power.
The Lesson: IT admins put their pants on one-leg-at-a-time, just like everyone else. Assuming something different is not sensible.