Connecting via remote desktop to a Windows 7 machine today showed the last couple of seconds of a windows device installing and the "Your device is ready" popup for a Sony Xperia T. Going to printers/devices showed an image of the phone. There's no bluetooth on the PC, and there's no reason for such a device to have been connected. Checking USB attach/detach logs showed expected entries and nothing concerning the phone, though that could have been tampered with. There's also no evidence of any virus, but the machine needs more forensic analysis on that front. Putting aside the most obvious explanation that a phone really had been connected, I'd welcome thoughts on alternative possibilities and things to check for any evidence.
UPDATE: There is a slim possibility that a phone was connected 2 weeks ago, however the machine had been logged into since then, and no device installed message popped up on those occasions. In this case the dialog was seen at the point of logging in again, just as if a device had been plugged in and the drivers had installed themselves, but a phone was definitely not connected at the time.
UPDATE2: Forensics show 4 keys modified including the following with data referencing an xperia at the same time as the remote desktop connect so there is some handle on the event, which seems to be triggered from the remote connect.
EDIT: 2014 Jan 28
As a postscript to this, a few days ago we replaced the drive in the machine which put it back to how it was at the start of 2013 (we'd copied the original drive to an SSD at that time), and long before there was possibly unauthorised access to the hardware. Looking at the list of printers today, the phantom phone appeared again, and it's guaranteed that one has not been plugged in since the drive was switched. The only software installed since was Skype. Very mystifying.