How about he contact CSIS directly, and clarify...?
Not trying to be sarcastic, but I'm really curious what such an email could possibly achieve. If they tell you they haven't done anything, they're either lying or not - you wouldn't know. And really, what are the chances they would tell you that they have rooted your PC if they had?