At the office if we suspect such we plug it a key ghost device. It's pretty amazing.
http://en.wikipedia.org/wiki/Hardware_keylogger
But as you suspect, after the fact is rarely recovered. Even more so if the machine is allowed to be used after the event.
Bob
So I'd like to be able to identify an email or user name for an email that was logged into from my personal PC. I do NOT need to access the email, only tell who logged in. The web history was erased so I've done a few things
1. tried to restore but didn't have a restore point that worked.
2. downloaded an index.dat reader program
-Found the transactions and identified it as a hotmail account
-found the exact time frame from the date stamps
3. downloaded a File Scavenger program to see if what i was looking for was deleted, no luck
I'm out of ideas and would really like to find out who logged into my computer. Thanks for your help!

Chowhound
Comic Vine
GameFAQs
GameSpot
Giant Bomb
TechRepublic