|Physical access means that he can sit in front of the PC.|
Hijack This will show you if there is a key logger.
Run netstat -an from a command prompt to show all connections.
Post whatever you don't understand.
How do you know when a politician is lying? His mouth is moving.