How long has he been connected? He could of luckily just gotten on, and didn't d/c right away. And it won't hurt to forward 3724 TCP and 6112 TCP.