MGM owns Mandalay and he was not an employee in their database. A reporter checked.
Shooter also checked in a few days before the ‘official’ timeline.
MGM owns a lot of things, and many of them are subsidiary companies that wouldn't have their employees listed in MGM's database.
It is common practice for a hotel to contract to a security firm, not hire their own security personnel. Perhaps that was the arrangement?