Dealing with Internal Attackers : Dealing with Liability??

I work at a uni, and regularly check what attacks happen on our network. In student season I always get a good couple of handfulls of machines on the network attacking other machines (usually over the internet). The problem is this: I have a report that I generate that tells me what username/source ip/dest ip/attack type/timestamp of the account/machine that was attacking the other people on the internet. However, how can I find a way to make them liable, or not liable for this kind of attack? They could easily claim that their machine had been hacked, and it was the hacker instantiating these further attacks. I worry because if nobody is ever liable for hacking/attacking other people then they can just get away with abuse/unlawful attacks scott free.