a user logged in then File-Open events shown for some files but user actually did not open those files