this:

Whever a user connects to a node, the unix domain socket localspy.sock is
create in the node directory.  This is a RAW connection to the users data
stream.  This is NOT a telnet connection.  Do NOT telnet to the UDS... you
will not like the results.  However, you can easily and safely do something
like:

cat /sbbs/node1/localspy.sock

Possibly netcat will allow you to remote control a users session... not
sure if nc supports unix domain sockets or not.   Have fun with this one.