I've done quite a few investigations and busts in this area at work. I am the Assistant Sys. Admin. and I occasionally run queries against our proxy log for all the keywords (ie.-sex, hot, etc.). Anyway, our network scheme uses computer names that are the same as the cubicle number that the computer resides in. That makes it really easy to track down the exact computer. A lot of places randomly name their computers, but if you really want to track someone down, name them in accordance with their physical location in the building.
Anyway, we had a guy who everytime someone would walk by his cubicle, he would shut off his monitor. Well, one day the Account Manager walked by and wondered why he turned off his monitor. She told him to turn it back on and he said, "No. I don't want to." Well, she forced his hand and he ended up turning it on to a screen full of pr0n. Well, he was immediately termed, but at least I got to surf his hard drive to see exactly what it was he was viewing. I like my job sometimes...