Turning on authentication on the proxy server will allow you to see which user does what.. A user then needs to "logon" before s/he is able to use the proxy..

Squid with NTLM authentication turned on can be used to authenticate IE/FF users automagicly.. Maybe Sambar can do that too..