Something is not right. The sequence of the story starting with the accidental invite and the total ignorance that the "guest" was there. The pieces of the puzzle are not puzzling. The ideal next step would be a forensic device audit.
Also, taking into consideration something as simple as UNC5792, what if the "guest" was bridged-in? iykwim
Readit News
https://cloud.google.com/blog/topics/threat-intelligence/rus...
[edit: yes, it is. https://www.scribd.com/document/843124910/NSA-full]
Also, taking into consideration something as simple as UNC5792, what if the "guest" was bridged-in? iykwim