It's not something you're supposed to be able to figure out instantly, but it's definitely something you should have figured out by the last Theon chapter
--
Kill every suspect, starting at one end.
The one left standing is your culprit.