As far as I know, the "best" solution for tracking report runs and exports is to purchase Event Monitoring from Salesforce, and utilize the data to check daily who exported what data from reports.
All orgs have some level of Event Monitoring enabled, and you can test using these log files in the relevant trailhead.
The data comes out as logfiles every 24 hours, and contains a log of what each user was doing, and when they did it. Each type of logged item comes with its own data (For reference, check the
ReportExport types in the documentation).
This does come with some downsides:
- Costs money
- Requires an external server for processing
- Tracks extra data
- Notifications happen 24 hours late (at best)
The upside is that you get every scrap of data you could need to take action, such as the number of rows, fields, and whether or not they ran or exported the report.
I've looked into some other solutions, such as custom visualforce "reports" where the page is just a proxy for a soql query, but each one requires time investment, which can be a dealbreaker when you need a solution now.
As an aside, it sounds like the client in question may need to reevaluate their data access on a per user basis, and adjust their profiles to disallow certain actions based on the level of data needed. This ended up being a solution for myself, where we evaluated our firing process, and determined when we needed to remove privileges from our users, removing our need for as heavy-duty tracking software.
Once you determine which profiles no longer need Report Export access, you can disable that setting in those profiles.