Currently, I've been tracking activity logs and connection times. The user is possibly hiding behind more than one proxy so it may take some time to go through all the accounts for irregularities such as Arisato-sensei.

Unfortunately, access to those logs are currently limited. Though you wouldn't have access to all of them, you should be able to get permission to see some of them, particularly for your own club. At the very least, if you see any strange networks such as "The Haunted School Belongs to Us" it may serve as a clue. But if you do see anything like this, I would strongly recommend you pass the information on to student council.