I recently confronted a user for not using his Google Apps account - the admin console indicated he had not signed in for about a month. However the user had been signing in and using his account during that time. Several people were receiving emails which he intended to send, so he proved he was using his account during this time.
I administer an organization's Google Apps account for a domain. The admin console showing the list of users in the organization has a column for Last signed in. The Last signed in column contains dates for users which signed in more than 24 hours ago and times for users who have signed in less than 24 hours ago, as documented here.
Why did this user's Last signed in value give a date of one month ago for the last sign in, even though he had clearly been using the account more recently than one month ago? It wasn't even close. The value said one month ago, but there are genuine emails from his account spaced out over the entire time, and the user says he was signing in.
Does the Last signed in column only become updated when an actual login occurs? I was expecting a cookie-based access to the Google Account to update this value, but perhaps cookie-based verification using the web does not update this column.