Didn't sound like he was creaming them at all. That one proxy admin will be a Godsend to the investigators. Better hurry up though. Proxy information and logs have a lifespan and a half life. The more time between the investigation and the review of the logs the harder it gets to get the information.
One word. Backups.