Interesting story that happened to me soon after I started the sysadmin role at our company.
One of our employees was in charge of programming and overseeing the CNC machines. Over the years we had upgraded to new versions of the the CAM software used for the machines. There was a folder on a network drive that held programs that were from an obsolete version of this software, many of these programs were for products that we had not made in many years. A few times over a year or so, it became necessary to pull a program from this archive folder. This person's assistant would go looking for a program and not find anything. He would go to his supervisor to inquire, with the response being "I'll look into it". The supervisor would then produce the program with no explanation of where it came from. This was shrugged off by the assistant a number of times, he simply updated the program to the new version and filed it in our new system. Finally the supervisor was on vacation and the assistant came to me, looking for a program that we should have had on file. I had some recall of there being a folder with old programs in it, but when I went to look for it, it was gone. I did a bunch of searches for this file extension, and found nothing. I ended up pulling an old backup tape out of the safe and what do you know, there was the folder. So this supervisor didn't have administrative access, or a combination to the safe to get at the backup tapes. Now I'm smelling something fishy.... I went to the owner of the company and explained what I was seeing and that I had no idea how this person was producing files from a folder that no longer existed. We then interviewed his assistant, who said he had seen his supervisor on a number of occasions plug an external hard drive into his PC and that he kept it in his backpack! I knew that the company did not own any external drives at that time. I was onto something.
That day after this person left the building, I looked through the contents of his desktop(we didn't have Spiceworks at the time, I had just inherited this network). I started finding all sorts of suspicious things, BitTorrent clients, DVDcloner, etc... So now I had some real dirt.
The next day the owner and I asked this guy into a conference room. I proceeded to explain what I'd found on his PC and how we were missing all these programs. After I implied that we might call the police, he produced his external HDD. We plugged it in and found the missing programs along with a menagerie of other company data. It seems that he wanted some sort of a bargaining chip to hold over the company's head should they decide to terminate him. Needless to say, he was terminated on the spot. Since then we've tightened up a lot of loose ends on the network. Truly a learning experience for me.