Is there a way to know who the user was that:
Deleted an alert configuration?
Unmanaged a Node?
Made a Settings Change?
etc.?
You can use the Message Center under alerts and activity for this.