You should be able to use the sys.dm_exec_sessions DMV to query host name, program name and login used by the session. That will nail it down to the point where you can go to someone's machine and find out what they're up to.