Leaving your computer unlocked usually also breaks policy (except if the policy is very much useless). The non-embarassing way would be to report the user leaving the computer unlocked, leading to disciplinary action and eventual dismissal. I think something slightly embarassing is the kinder option here.