One assumes the pass would be rejected if use was attempted before the permitted time, so it's not clear how any auditing would be possible, unless I suppose the OP travelled from an ungated station before the permitted time and arrived at a gated station after that time.
Absolutely - on buses at least, these passes are rejected before 0900 with the driver being shown an error which says tried to use before valid time or something vaguely along those lines. I see no reason why gatelines or standalone readers would be any different. I imagine you're right about the ungated/gated situation (although a clarification from OP would be good to know) - and if they're tapping in and out at the actual origin station on the return, it'd be pretty clear I imagine what they've been up to.
Even if they are not tapping out though on the return and just tapping in, it's probably apparent that it's being misused simply by the timings - e.g. if tapping out at, say, London Bridge at something like 0932. But it would be a lot harder to work out how far they've actually travelled.
However I mainly just wanted to add the obvious to this thread, and suggest when the OP is contacted they refrain from taking the position of 'I disagree with this policy' and adopt a much more apologetic and concillatory tone. That tone will put to bed any small possibilities of final written warnings or other out of court procedures that TfL may (rarely) opt for...
