How do I monitor which Windows user is logging in as SA?
If you can identify the query that is causing the problem (e.g. via session_id in sys.dm_exec_requests), you should be able to resolve the host_name by checking the same session_id in sys.dm_exec_connections. In lieu of an actual Windows account name, you should be able to tell who it is by the host name they're connecting from (assuming they aren't all using Remote Desktop and running queries locally too).