Look at the user's activity to see if it's suspicious.