I would run a trace, for as long as possible on just activity relating to SA, save that info to a file/database and then do some good old fashion data mining....

Link for info on creating a SQL server trace using SQL Server Profiler

https://msdn.microsoft.com/en-us/library/ms175047(v=sql.105).aspx