You provided default values for the token and the user which means if the user does not empty those fields your validation will always pass, i would change the default options for token and user to an empty string.

Personally i am not a big fan of determinating the state of an agent which is receiving events based on the time frame it received the last event. I would rather base it on the (un)successful delivery of the events it received.