You can view hidden Temporary Internet Files located on the user's computer, and see the date & time they were accessed. Match this up to when the user is logged in and you have pretty good proof. To do this, you'll want to be sitting at the user's PC, probably after hours. You'll also need to show hidden files. To do this:
Open My Computer. Click Tools > Folder Options. Click the View tab. Look for Hidden Files and Folders and select the "Show hidden files and folders" option button. Scroll down a few more lines and clear the "Hide protected operating system files" checkbox. Click OK.
Next, inside My Computer, double-click the C: drive, then Documents and Settings, then the user's name. Look for and double-click "Local Settings". Notice that this folder is a bit faded, duller than the other folders. This is because it is a hidden folder. Had you not performed the previous steps above to unhide files, this folder wouldn't appear.
Inside the Local Settings folder, double-click the Temporary Internet Files folder. You will see one of two things:
1) If you see a long list of files, you are looking at files that were downloaded while the user was browsing the internet. At the top of the window, click the Views button and click Thumbnails. This will let you see the pictures that are on the webpages visited by this user. If porn sites have been visited, um, you'll know it. Scroll through the list to find your evidence. If you do see porn pics here, make a note of the file name(s) for the offending pics. Then, click the Views button again at the top of the window and change the view to Details. Scroll back down to the file(s) in question, and look across the columns to the Date(s) columns--could be Date Modified, Date Accessed, whatever. This will show you when the files were downloaded/accessed. Hopefully, you'll find that the pics were downloaded after hours when your employee was gone and the cleaning crew was in. Probably not though...
2) If #1 above isn't true, you might see a folder called "Content.IE5". Double-click this folder and you should see several folders with random-looking names (01LK2W2Z, for example). Double-click the first folder, and you should see all the Internet files I mentioned above. Continue with changing the view to Thumbnails, look for porn, note the filename(s), change the view back to details, and note the date & time.
ALSO, if you don't find any evidence by performing either steps 1 or 2 above, also browse (using My Computer) the files and folders under C:\Documents and Settings\Fred(user's name)\Local Settings\Temp\Temporary Internet Files\Content.IE5. This should show you more randomly-named folders, each containing temporary internet files.
These are some long instructions, possibly confusing. So let me know if you get stuck anywhere or don't understand something. Also, each network is a bit different, so your user's files may be located in a slightly different location. I could help you out more if you were sitting in front of the user's workstation.
ALSO, if your employee is smart enough he/she may know how to clean out these folders I mentioned (using the build in Disk Cleanup tool inside Accessories folder won't clean these files). Evidence of him/her cleaning these files would be if you go into these folders and they're empty. If there's no files here, chances are the user has cleaned up his/her traces.
And LAST, but definitely NOT LEAST, if you don't want the employee to suspect that you were snooping around on his/her computer, you'll need to re-hide those files and folders. To do this, inside My Computer, click Tools > Folder Options. Click the View tab, scroll down to and click "Do not show hidden files and folders". Then scroll down a few more lines and place a check mark inside the box in front of "Hide protected operating system files".
Whew! Hopefully this gives you the info you need.