At least when these people are rooted from parent folder, it could well easier to go your file modifications audit.
The infamous "admin in the shoebox" won't impress and subject to some thorough investigation without difference.