It was compromised more than once. He kept claiming it must be physical access, but the information he shared about the attacks points more to an IPMI, BMC, iL

It was compromised more than once. He kept claiming it must be physical access, but the information he shared about the attacks points more to an IPMI, BMC, iLO or iDRAC type interface being unsecured. He also didn't use FDE on the server which made the attacks possible...