1. A method, performed by a computer system comprising one or more computing devices, for associating IT activity events with user logon sessions in order to track user activity during a logon session, including device accesses and user account switches, the method comprising: for each user logged onto the network, maintaining on a storage device a logon session state for the user that reflects events, host devices, and user accounts associated with the user during the logon session, wherein a logon session begins at a user's logon to the network and ends at the user's logout or a specified period of inactivity; for each host device in the network, maintaining on a storage device a device state that reflects all users logged onto the host device and the user accounts used to logon to the host device; performing the following steps on the one or more computing devices: receiving an event log for a user event, wherein the event log indicates that a user has accessed a host device in the network (“the destination device”) from another host device in the network (“the originating device”); identifying from the event log the destination device, the originating device, and a user account used for the event (“the event user account”); and determining whether to associate the event with a user having an open logon session by performing the following: identifying all users currently logged onto the originating device and all user accounts associated with the originating device; determining whether the event represents a switch that has already occurred from a user account on the originating device to the event user account on the destination device by identifying whether only one user is currently logged onto the originating device and said one user is using a different user account on the originating device than the event user account; in response to determining that the event represents a switch that has already occurred from a user account on the originating device to the event user account on the destination device, (i) associating the event with said one user, (ii) updating the logon session state of said one user to reflect the event, including the user account switch, and (iii) updating the state of the destination device to associate said one user and the user account with the destination device.