[schoen]

This might be different if you have 4 users on the system or 400 users.

Also, traditional Unix makes it easy to find out who was active on the system at a certain time (for example with the "last" command, which reads the wtmp log), plus other data sources (historically regular users were often allowed to read most log files by default, and people often used relatively open file permissions by default, which would at least allow for examining other users' file metadata).