Find returning users from access logs