Glossary
MountPoints2
The NTUSER.DAT key listing volumes mounted in a user's session, by volume GUID: the registry link between a USB device and an account.
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 has one subkey per volume the user's session saw, named after its volume GUID ({7d3f8a2c-…}), plus network shares (##server#share).
Match the GUID with MountedDevices to find the device. The subkey's LastWrite time approximates the last time that user mounted the volume. See which files were opened from a USB stick.