Re: Every time
That reminds me of a time when we also noticed some porn sites appearing in our proxy logs. It was only a small company with 15 developers, so identifying the machine used was not difficult, so we thought..
However, the timestamp was from early in the morning, before any right-thinking developer would have dragged themselves out of bed and into the office, so we were curious how it had happened.
It began to happen on a regular basis, a couple of mornings a week, but not always from the same machine, and so we decided to look more closely. The days and times coincided with the hours that the office cleaners worked (06:30 - 08:30, Tuesdays and Thursdays), so we approached the cleaning company and asked them to talk to their staff.
It still kept happening, so we set up a webcam overlooking the desks, but disguised inside a cardboard floppy container. The next morning, we reviewed the footage, and found that one of the cleaners used to bring her teenage son into work with her, and he would wander round the desktops until he found one that had been left unlocked, and would then amuse himself with a bit of porn.
We showed the footage to the cleaning company, and the cleaner was disciplined. We also had a rant at the developers about leaving their machines unlocked overnight.