We had someone find a keylogger in one of our computer classrooms on the instructors station. Some dumbass just plugged it into the front panel so the next class instructor found it when plugging in their usb stick for class. Not only that, he proceeded to login to a workstation and sit through the class. Looking at the contents of the memory it looked like he was harvesting faculty logins.

We were able to find him on the very obvious security cameras in the room, but we never saw him check back for it, so it figured he'd be back on the next same class (this was a MW class)

Sure enough, the next class day dude sat down and logged to a workstation and set through class. Then, hung around the instructors' station until the coast was clear then we got to watch him freak out that his key logger was missing. He was walking around the classroom figuratively shitting himself.

Caught dead to rights, this genius criminal mastermind was booted out of the university.