Check out the logs in /var/log/samba/

Typically you can see from what IP a user logged in from, and what shares they have requested. However I'm not sure if even increasing the logging level...