Originally posted by maachan
If this was issued from OS, then do

last | more

at OS prompt

You can see what was logged on from what IP address at what time.

That might help to narrow it down some.
last only shows who was logged on and not what commands they ran. There was nobody logged in to the box at the time. I would need lastcomm to show me which commands were executed, but that relies on OS accounting to be turned on.