I think that by running the logminer, you would be able to trace the sessions to the last and from that pont you can kind of get who was that black sheep. :D

Sam