I expect investigators to follow up on reasonable suspicion, which is what unusual market events or behavior should arouse. The crime and the perpetrator are found at the same time, because one can't exist without the other, legally speaking; to start with a definitive crime is to assume guilt, which, as you say, is incorrect. You triangulate on the crime-perpetrator (think space-time); this, of course, means that you must investigate people who are merely suspected of committing a crime. Some will be wholly innocent. Some will present evidence of crime other than the one you initially suspected; you should pursue that, too, in the interests of justice.
Speak only for yourself, please.
>How exactly do you tell the difference between the trader who fleeces millions and the trader who is simply good at their job and makes an equivalent amount of money?
Most tyrants don't believe they're actually tyrants.
The point of an efficient market is that it's difficult to beat, and the difficulty increases exponentially. Unless you cheat.