You could also use logoff user if you've got an agent on the system, it might interrupt them... all of these things are after the fact, but if they are doing a lot of damage you could catch it mid-stream.
If it's USB they are copying to/from, you can also detach the device with USB-Defender...