Look at v$filestat to find out which files have the most I/O. Then figure out which objects are in that datafile. From there, you should have a clue as to WHAT and WHO and you can analyze this person's session to find out WHY.