This week I talk about a triage methodology for examining suspicious user accounts.