without looking at the system remotely cant say what is going on for certain.
There is a history gap, ie installation door removal, device replacement and event log.
The tamper set off the alarm which is what I would expect when device moved.
The device not registering as you suggest would indicate a fault, but your saying there are no faults in the log.
I would have expected polling errors and eventually a supervision fault.
If the devices manage to poll in, within the two hour window, I would expect a supervision fault not to be in the log.
However if that was the case I would expect the device to function, at the very least the rear door as that was untouched?
I would look at the whole event log downloaded via wintex, and go as far back as i can datewise, ie to door being replaced if possible.
I would look at ricochet monitor to see how the devices are being seen by the ricochet and look at ricochet diagnostics.
If the devices hadn't been talking for a long time, I would expect to see in ricochet diagnostics nothing for the front and rear doors ie blank as no data received, in ricochet monitor I would expect to see the last coms in and a blue device suggesting it hasn't polled in.
Based on this information I would then be looking at the front door and frame and want to know its construction, but this all depends on the data the system has or doesn't have.
We could then look at the devices specifically and do some tests.
I would also look at zone programming, just things don't quite add up at the minute, but that could be the communication of the problem.
So there is a lot to look at, but pretty much al of it can be done remotely.
If you don't have a service contract with the engineer that installed it then anyone can take a look, if that engineer isn't available to do so.
Were they a security installer or someone that installed alarms?