I found this bit confusing, because "once in a 4-week period" means "once". In other words, "An ASP can run away with users' funds if the user is not online all the time".