Minecraft – How to transfer the contents of a player’s enderchest to a different account

Unfortunately, it appears the answer is "you can't, or at least not without spending a prohibitive amount of time on the investigation, and even then you won't be sure of anything."

If someone finds a solution that's less time-intensive, I'll happily accept it instead of my own bleak conclusion. But after a lot of research I suspect there isn't one. I've updated the question to clarify that solutions ideally won't require hours of tedious manual work or monitoring.

I appreciate the answers that have been submitted so far. Unfortunately, manually searching everywhere for a stolen item would be too time consuming, and even upon finding it you couldn't be sure who put it there; it would be easy for a thief to frame someone else. And watching a potential crime spot continually until the crime happens would take too long since there are several possible griefers, many locations that could be griefed, and thefts are often spread out in time.

So for the time being the answer seems to be:

1. Use the techniques that I outlined in my question, whether using InvEdit to inspect player inventories, or else manually copying their [username].dat files to inspect inventories and Ender chests. If it's in their inventory or Ender chest, there's no question who took it.
2. Or give up and install Bukkit or Spigot and an anti-griefing plugin like WorldGuard or Prism.

We switched hosts and installed Spigot and Prism, and it was 100% worth the effort. Spigot runs even faster than Vanilla Minecraft did, and Prism is awesome for tracking down offenders and reverting their evil deeds.

Each player has their own file in a world's playerdata folder, named by their UUIDs:

These files contain their inventory, location, health, etc.

Note: If it's an older world there may also be a players folder with similar files. Ignore this, it is obsolete and does nothing.

In addition to this storage location, on singleplayer, the player's data is stored in level.dat, always under the name "Player". This file contains other data, and you need to use the editor NBTExplorer in order to view contents and manage the data:

On singleplayer this default "Player" version takes precedence. If it exists, it will always be used first, and it doesn't care who the user is, so long as it's singleplayer. Both of these locations are saved to with your current in-game data.

This means that you can play a world on singleplayer with one account, then give it to a friend (or upload it to a site) for other people to continue where you left off (still on singleplayer), it will use the Player file rather than the one specific to your UUID.

As LAN worlds are created by first launching singleplayer then opening the world to LAN, this Player data in level.dat will be the data of the host, Player A. As you are now opening the world on singleplayer (before opening it to LAN), it is using the data of the Player file, or Player A's data, rather than your own UUID file.

This also means that the data for your character stored in the UUID file has probably been overwritten with Player A's data. Everyone else still has their own UUID file intact, as they've only logged into the world while it is on multiplayer.

To fix this, you'd first need a backup from before the transfer. In level.dat, delete the "Player" section and then log into the world on singleplayer. This should force it to load your UUID file and then re-create the Player section in level.dat based on that, rather than the other way around. Everything should work fine from there.