How to Investigate Insider Sabotage Properly