Someone from support must have been assisting him in TMT and logged in as the sysdba users. By default, the system writes the last user id back to the transman.ini file hence why that was showing up.
We have volume shadow copies enabled on the user profiles on CENT-DC01 in the Shares\RDSHomeDIr folder. I went into his profile > windows > right clicked on transman.ini file and went to the previous versions tab and just restored one of the older ones.