Concord 4 issue or user issue?

[Effenpig1 <dirtyspicevent@xxxxxxxxxxx>]

Had a customer call with a issue I've never come across before. Here's
what happened: Installed a Concord 4 at her house about 3 months ago.
I taught her to arm to stay with no delay at night, and then she
changes it to away when she leaves. Her daughter and son-in-law are
visiting, she left early in the morning and switched from stay to
away. After she left the daughter came out of her bedroom and tripped
the living room motion.

Here's where it gets weird: Son-in-law calls me and tells me what
happened, he says he's concerned because "the alarm went off for about
10 to 15 seconds and shut off by itself" ( Not just the siren stopping
but a full clear)

I checked the event logs and heres what I found:

Zone 11 alarm then  5 seconds later an E406 cancel/abort by user #
U846 ( master code)

I'm thinking frazzled daughter gets crap scared out of her, panics,
punches in code, then somehow forgets that she did it. Her and her
husband were the only ones there and he didn't even know the code
anyway, so I'm sure he didn't cancel the alarm. Also, there are no
keyfobs or wireless keypads/remotes, 2 hardwired ATP1000 keypads.

I tested the system, arming it the same way they did that morning, no
issues. I'm going to run it by GE tech support tomorrow morning. I'm
99.999% sure it's just user error, but that .001% bugs me.

So what do you think, is it user error? because I can't imagine what
else it would be.  Any thoughts?