To be pedantic: it depends on the last activity of the client, not the user. Anything the client sends counts, even if it's not as a result of user action. This makes it incredibly hard to figure out what could reset that timer - you'd need to know the user's client, its configuration, its plugins and so on.