Solving tricky questions with Maltego

Often I find that Maltego can solve some pretty tricky questions - as long as you can think out a logical series of transforms to get to your answer. When you have it all worked out, it can seem very intuitive - but the initial work is actually quite tricky.

Take the example of "How can I find sites that employees at company X are looking at?". Initially that seem pretty much impossible, but with a series of transforms we can get a good result i.e:

1. Find an IP of the companies network (Check NS for sites, MX for sites etc - to discover an internal server using an address belonging to the company. Or just bounce an email off their servers that you know will fail)
2. IP->Netblock
3. Netblock->All IPs
4. IP->Websites where this IP appeared
5. Prune the results.

I'm wondering what other tricky problems people have solved with Maltego, and how you went about doing it?