as Michael says have a look at the account and ensure that it is assigned rights to the auditing role. Auditing should be available for your SP. Don't use the sys admin account for auditing.
In the admin console you do some basic stuff which may help. You should be able to add a field to the view to show the date (and time) of the client connection. You can either sort by this or export this to excel and sort there to see the oldest date and time.
The only thing is if the client time out session is exceeded and the user later reconnects I don't thing this is reflected in the date and time for that session in the admin console. Maybe the auditing shows more detail for you.