Easy, you know what is logged and what is not, so log in as the person (not from your own pc), send the person a lot of pornsite URL's (both strait/gay/lesbian/shemale) from his/her own mail account, remove the mails from the "sent" folder.
When the person reports this, tell them (after some time) that it looks like someone have hacked their mail account. That should teach the person to take security a bit more serious.
Biting the hand that feeds IT
