We built a database of all our sites, all the users in the sites, and the last login date for each user/site combination. Then we built an application that loops through all of our sites on a nightly basis and checks the last login date for each user on the site and, if it differs from what was previously in the database, adds it to the database. We built it to be able to provide rough daily usage metrics, but it sounds like it'd probably help you issue spot specific issues like this. Then, should an issue be spotted, you could drill into the individual site's data for more detailed information about what the user did while logged into the site. (One caveat, this solution doesn't record activity of System Admins who aren't otherwise Members of the site. It just doesn't "see" them at all.)