The only reliable evidence of an internal person attacking your systems is if you catch them with their fingers on the keyboard.
People often suspect insiders because they have spent an extraordinary amount of money building extremely sophisticated defenses, and they simply cannot imagine a hacker being able to navigate them. They have grandiose releasing processes that assure that only code that has passed through QA will be released into production. They have firewalls blocking attackers, NDIS scanners looking for attacks, anti-virus tools at all the endpoints, and DLP tools to watch for data exfiltration activities. They have all the right processes, best practices, projects, plans, spreadsheets, audits, and endless checklists.
Meanwhile, the hacker doesn't know about any of this stuff. They simply exploit a hole, and escalate their privileges; then laterally move about the network using stolen credentials appearing like any other legitimate user. Eventually they find their way to a machine that contains valuable information. They either use customized, modified tools that don't trigger AV or NDIS scanners, or they use the OS's own tools already present on the victim's machines. Once they find the data they're looking for, they encode their stolen goods to avoid DLP tools, camouflage it to make it look like ordinary traffic, and ship it out.
When you've invested so much in building a security system that appears formidable, it's hard to believe that the attacker can be anything but an insider. Instead of leaping to the assumption that it's an inside job, it's your duty to keep digging until you find the actual trail.
Your best bets are going to be searching through independent logging servers, ones where the attacker may not have had access to corrupt the logs. Once you've identified the credentials, track back to the machines where those credentials were used, looking for the evidence of the attack. Router, NDIS, or firewall logs are also going to be helpful.