I won't red-flag anyone based on your observations.
The evidence isn't compelling enough to do that, in my opinion. It also could have been a sophisticated attack on that particular user/group.
I guess it's fair to add a few (more than a few) users to my ignore list.