In Server System log there should be a detailed list of all events that happened to the system.
In Exchange Manager there is a record of who logged on when, you can try to reverse engineer and find the cuprit but I agree w/ Mark, restore the folder from backup or archive and set specific permissions for it.
I have a 'crazy clicker' on my network and he has zero permissions for entering/deleting data on any public folders except his own.