" You should also attempt to do a print history to see if you can identify days/weeks of any abnormal heavy printing and identify the customer and document types (maybe the printing of trial balances). "
If you have a network printer, most save documents to a printer hard drive. Your printing programs might be able to tell what documents were printed and by whom. Electronic copies may still be on the hard drive to ID.
_________________________
Integrity. With it, nothing else matters. Without it, nothing else matters.