Adjust permissions on user events to let Moderators only see login, logout, and user creation events, not other types of events (password changes, etc). Admins can see everything. These other types of events are meant for account security purposes and aren't very relevant for sockpuppet detection purposes.