Login audit trail Am I wrong? If the same email login credentials is used to login into production and sandbox (… and other accounts …) you can not detect where you is logged? Login audit trail is on the “NETSUITE” layer?

This doesn't sound right. If you are viewing the login audit that will show authentications for that account only. Otherwise it's a security issue and other accounts where you use the same email could see all you activity.