There are a variety of tools at your disposal already, which your question (and these answers) hint at like history, snoopy, auditd, sudo logs, etc...but if you have a "Subset of accounts" people are using, there's no way at the server to tell who did what. The only way you can specifically tell who did it is if users have their own computers that they use specifically and use keyloggers to tell what they were physically typing at that keyboard.
Whenever you share accounts you can't tell what was actually going on, since you'd need further proof who was using your root account or bob account or whatever your people were doing. If you're trying to investigate what happened in a specific incident, you may need to review your access policies and procedures, your recovery procedures, and evaluate your employees and/or engage in retraining if necessary (or their trustworthiness with sensitive accounts) rather than directly focus on hunting down who did something, as it may suck up more resources than you stand to gain in finding the person who did it.
Otherwise you might want to look into forensic investigation techniques for tracking down what happened (drive imaging, log tracing, etc.) If you're not investigating an incident, look into reviewing your policies and instituting better tracking and account verification (only you have root, only Bob uses his account using sudo to get access to higher privileges, install and monitor auditd, etc.) and be careful not to make your trusted circle feel like they're being held under a microscope or you might alienate the people trying to get their jobs done (or hinder them from getting their jobs done).
