It has a finite buffer, so I imagine 6 months worth of logs would have easily blown away the history of you running the command.

You can configure it though, to be much larger than its default settings. Still, 6 months... he'd probably have to hack it as he did, no matter what :-)

Exactly.

he didnt invoke it from within screen it looks like - it was invoked with the invocation of screen