You could also check the Event Log for any after hours logins.