I had a client that had charges they dont recognize attempted, logged in under their user name. This merchant is strictly processing 9-5 M-F and from the office - no one works remote or off hours (geez...are they hiring?)
MX4 had the ability to restrict the IP address from which one could log in, and this would be very helpful if MX6 had the same option as that would all but prevent these unrecognized log ins.