For the first time (I think) the same IP address shows up twice in a row when I check the locations from which Evan last logged into his email.
Browser 91.61.81.88 5:02 pm (18 minutes ago)
Browser 94.136.16.242 2:04 pm (3 hours ago)
Browser 145.100.100.190 1:39 pm (3.5 hours ago)
Browser 145.100.100.190 11:37 am (5 hours ago)
It's an Amsterdam IP, so he's obviously not there. Maybe it just indicates one really long session online.
And @mescad has a smart summary post of the first week.