Why is monitoring user accounts an effective way to identify suspicious activity on networks? What types of abnormal behavior and patterns would be monitored to ensure malicious activities are present on a network