I was running some checks today on a LTA who came back to use an IP I had hard-blocked some time ago. There's two events in the CU logs, about 10 minutes apart on that IP, with no intervening activity:
(User logs) 00:12:06 <User X> (talk | contribs | block | check) Successfully logged in to Wikipedia as <User X> (User logs) 00:11:57 <User X> (talk | contribs | block | check) Successfully logged in to Wikipedia as <User X>
I'm assuming that between those two logins, they tried to make an edit, got blocked from saving the edit, and tried logging out and logging back in to see if that would fix the problem. Would it be possible to record the user logout event?