Tried sawmill?
It's not in an easy place on the IronPort site though, under Documentation.
Once you get it set up, you can give it logfiles from the WSA, have the WSA push logs over, or have sawmill pull logs from the WSA.
I usually set a filter for the user i'm looking for, then run a 'single-page report' for people requesting usage reports.