As an IT guy (posting from work), here's a few points:
It's tough to look at logs, and most reports, and be able to tell the time-wasters from the work-related users.
However, once you make the 'problem user' radar, you'll no longer be in the 'pool' of traffic, and instead be moved to the...