NYS is known for taxing first, asking for proof later. Happened to me as well. This should not be news to anyone who has NYS nexus, so logs should be kept. For the employee part, I would tell them to pound sand, since their own state worker/union family does not require hour tracking for salaried employees.
It remains tough to prove a negative, so one must look at their own situation and make decisions. Such as those who are inactive members of a corp not wanting to trigger employment and tracking what they actually do in case challenged.
Since I am not a believer we still have privacy, I allow google to track me (my phone) at all times. It has been handy for me for several reasons. In the timeline, you can relatively easily search for or see how many times at specific locations, which would likely be a great help for this situation.