Indeed, we can't actually detect "digging" at all. All we can detect is when dug outputs move for the first time. It's quite possible that he already has 500k CLAMs in his wallet, and is just spending them one output at a time. In other words, "digging up old CLAMs" doesn't leave a mark on the blockchain. To dig all you do is import your old wallet.dat file into your CLAM client. Nothing hits the network until you move or stake those dug CLAMs, which is what we're seeing now.