That sounds about right....since you know who it is and he works in your company, try monitoring his computer. Either remote logging, IP monitoring, or key logging would be good options.