Also, knowing how they login would help too. If they are accessing files using Samba for example, then smbstatus would show you that information.
I can recommend the last command though:
last | grep "still logged in"
Will show you who is currently logged in but it also shows you which terminal windows you have open, and if you're su'd to root etc.