Airplay prank, need to find culprit

I am a desktop support technician at a highschool, and a few of our staff have macbooks instead of windows computers. Specifically one of them has a macbook pro with retina, and os x mavericks. Today a few images poped up in full screen on his macbook, and it looks to me like someone did airplay from their device to his.

My question is, is there a log of this kind of activity that might give the ip address, mac address, or device name or any such information, and if so, where would could i find that log file?

When airplay is implemented from one Mac to another, a notice on the receiving Mac pops up asking for permission to accept the file(s). So unless permission was given, it was likely something else that was responsible for the images. Are your computers all on the same network?

Within the same building it functions as if they are all on the same lan. I spoke with apple support and they told me airplay does not let you airplay from a phone or tablet to a mac, so I'm suspecting he has a third party program on his macbook like reflector, which i have found does have log files. Waiting to hear back from the staff member if he has such third party software installed.

Let's clear up some confusion here: AirDROP is a feature on the latest OS versions for OS X and iOS that does, indeed, let you move files such as images from one device to another (with permission).

AirPLAY is an Apple wireless technology that lets files from a Mac or an iOS device be transmitted TO an Apple TV or other AirPlay-compatible receiver. AirPLAY does not move or stream files from OS X to iOS or vice versa, as the Apple representative told you -- though they omitted the fact that certain third-party programs can allow this to happen, such as Reflector and X-Mirage.

I think we can completely rule out AirDROP as being a factor here. AirPLAY might also not be the culprit, since it also usually requires admin-level privileges to work.