It might not be a particular user -- you might just have an overall heavy load on your system. But 99.44% of the time it is a particular user (or a small set of users) running poorly indexed queries.
If it is a particular user it is probably the one who is at the top of the User IO screen. Especially if that user is far and away the heaviest generator of logical IO. If that is the case then the next thing to do is to look at "Table Statistics" and determine if, perhaps, a particular table is also being hit much more heavily than any other. If that is also true then look at "Index Statistics" and determine which index is being used.
If all of the above works out then you probably have a "rapid reader" type of problem and you know the user, the table and the index. If you have 10.1C or higher then you can take it to the next step and find out which line of which program is responsible. But you will have to use PROMON, R&D, Status, Client Database-Request Statement Cache. Turn it on for the suspect client (or for everyone) and then see what they're running.
ProTop doesn't currently show the Client Statement Cache because, until recently, very few people had 10.1C+ deployed. But that's changing and ProTop is due for a new release Real Soon Now.
