A partial solution may be that whenever a user actually makes a change to an incident, such as modifying status, severity, or attributes, a notation is made in that event's history. Filtering your report view by "Incident History Issuer" for the user in question, and perhaps by "Incident History Detail", can give you some of this...