I don't use Gnome (or gdm), but if the behaviour persists over reboots
it surely MUST be stored in some file; if you can pin-point the time
& date at which your grandson would have done the keyboard magic, maybe
you can use find to hunt the culprit down?
E.g.: the boy did the change roughly 27h and 10 minutes ago, with a
window of opportunity of 15 minutes ...
find / -type f -mmin +1630 -a -mmin -1645
Of course, I can't guarrantee that GDM doesn't store it's config file(s)
EVERY time it's (re-)invoked ... but then again - that should be easy
to find by looking at a) very recent modified time stamps & files that
belong to the package that holds gdm ...