Sounds like a simple misunderstanding to me. Employee thought they were doing something acceptable to formally disengage from the project and just wanted to monitor traffic. IBM interpreted it as an attempted end-run-around. Not surprised, virtualization stuff is still in demand, sounds like typical IBM-internal perl-clutching going on.

I used to work in Global Services for a few years starting in 1999 when I was fresh out of school (on-site "Customer Engineer" for hardware break/fix). I don't think all divisions have the same requirements, but we had to sign documents explaining IBM owned everything we created on our free time at hire-in. I was young but I had built enough software and hardware projects by then that I realized this was a bad deal. Linux was just starting to get enterprise recognition and open source in general was starting to really take off. My manager and others all laughed when I pushed back on signing this, "what does this kid thing he's going to invent on his own time?".

I filled out the paperwork noting the exceptions of things I had already built. However because my location was fairly distant from any central IBM office I rarely saw my manager (he worked about 80 miles away from my location). Once I realized this paperwork never got filed I just let it drop. When I left the company I noticed they had this same paper signing over all my IP rights to IBM at my exit interview. I was still young and dumb so I signed it rather than telling them to get bent. However I had been so busy those years that I hadn't done much of anything in my free time. But yea this sucks and it's a thing. Yet another reason why anonymity is still needed in the modern world.