A new event is added to the log (System Policy \ Event Log) called "impersonation.start" when someone impersonates a user and then "impersonation.end" when it ends. The user ID of the person doing the impersonating is stored in Parm1 and Parm2 has the impersonated user's ID.
I don't know how visible blog posts are, so I'll add a link here to a post I wrote based on this thread: http://community.service-now.com/blog/capajc/track-impersonations-just-new-table-and-two-script-actions
