Look to see if he has anything that he is (by default) trying to access remotely. A network share. An IP address. It might be that there is something there (spyware? virus?) that is trying to call home over IP, and his network settings are rigged to try an autoconnect on demand.