I get into the office and find that someone had disconnected the cable to the T-1 line to prevent further 'hacking'.
Of course, I knew all along what the problem was.
The day before I'd replaced the receptionist's mouse with a wireless mouse. There was another user with the same make and model of mouse, but he was a good 25 feet away, with several walls in between. I'd hopped that was enough distance between the machines to put them out of each other's range, but apparently not. Sure enough, moving that person's mouse would cause the pointer to move on the receptionist's machine. All the activity was just coincidence. There was no hacker, no virus infection.
Still, just to be on the safe side (and justify my timecard), I ran some virus and spyware scans. Nothing, just as I suspected. Nothing unusual in Sysinternals Autoruns. Nothing in RootkitRevealer. Nothing out of the ordinary in Process Explorer. Nothing unusual in the firewall logs. If it's a hacker or a virus, it's something incredibly advanced. (Of course, if it were that advanced, why would it need to take control of the screen and use the mouse to do things like copy files?)