SQL 2008/R2 Extended Events - Row Count
That's a bit insane to capture all running queries no? Queries from a specific user or including the ones from sproc, ETL, etc? If they are coming from an unauthorized location, that tells me that your DB is not locked down enough. If one instance has 20 DBs, each of the service accounts, domain users or even SQL login should only been given access to the database pertain to them. The people who are the owner of these accounts (who knows the password) are usually gone trusted and have gone through background checks. 

Otherwise, they are 3rd party SQl tools that like idera dm , SQL Sentry and even pefromance dashboard that comes with SSMS 2016 that keep track of queries applied to the database.