The identities are stored within MySQL, roundcubemail.identities
Just have a look through those and cross-reference the users against roundcubemail.users to see who owns what Identity.

Try the following script, it'll give you 3 columns, user_id (you can ignore), username which is the REAL E-Mail address, and username which is the Probably Fake E-Mail address: (It only returns user+identity combinations where username doesn't match identity email) [Keep in mind, the identity might have been removed since, and there is no way to find its owner]
BTW if user is able to forge identity from Roundcube, then they might be able to forge their from header using other SMTP Clients. Check your postfix main.cf for the line starting with "smtpd_sender_restrictions" make sure that "reject_sender_login_mismatch" is in the line so that it looks like such:

smtpd_sender_restrictions = permit_mynetworks, reject_sender_login_mismatch, permit_sasl_authenticated

SQL Code:

SELECT users.user_id, users.username, identities.email FROM users LEFT JOIN identities ON (identities.user_id = users.user_id) WHERE users.username <> identities.email;