Is there anything that can cause a PLC5 to switch to program mode then back to run mode, other than someone switching to prog mode with either software RSL5 or turning key switch?

Background: Yesterday I got called in. Through our historical trending I eventually found that the root cause of the upset was one of the PLC5s going into program mode for 4 minutes then back to run mode. It was back to run mode before I arrived. One electrical tech on site at the time. Says he was no where near the PLC or prog software. I've known him for 10+ years and I have no reason to doubt him. RSL5 could have been open on a pc accessible to anyone (control room, shop, etc), but these folks (12 on shift operators) are just not like that, to fiddle with this stuff. Our 5s are accessible through our corporate network via CLX ENBT and DHRIO bridges. We do not use firewalls (long story) or programming passwords.

If you rule out the people the only thing left is the hardware. Keyswitch on the CPU unit maybe. My money is on people.

What are the possibilities for someone to remotely access in??

Our investigation is looking into that possibility.

After some further discussions with the tech on shift that night we found out that he had made the switch. I'll follow up further with him when he's back on his next day shift.

Thanks again. I appreciate the replies fellas.