The basic idea is that we knew there was a decent chance that Graendal was planning to meet Rhavin in Caemlyn then in order to link up and go to assist Sammael when (they thought) Rand attacked him. So she shows up during the fight and sees balefire flying around everywhere, and knows that she can't track Rhavin down in order to link with him, since she would probably get killed before she had time to do so, so she hangs out and hides, waiting to see what happened, and if there is any advantage she can get from it. Asmo walks in, and he can't be allowed to live because he knows her, so...*shrug*

We know from her character(even at that point, and more later), that Graendal is the sort who likes to be very careful, but isn't a coward like Mogy. So she is exactly the sort who would find a safe place, then hide out to see what advantage could be gained. All of this pointed to the possibility that Graendal was behind it, which is why she has always been one of the top suspects, but hardly proof.

The reason we were supposted to know is because we knew that Graendal and Rhavin were meeting regularly in order to be ready for Rand's attack on illian. This was enough to put her into the most likely suspects list, but hardly enough to determine for certain that she was behind it until it was revealed in ToM. I think that RJ just overestimated how easy it would be to figure it out because HE knew which facts were important and which were not. He knew that there was no way Lanfear could have done it(we didn't know enough about the Finns or her fate to know that), etc. If you know what evidence is the critical evidence, its easy to reach a conclusion. If you do not...*shrug*