Deleted Users in ERP need to know where to track

We have a situation in Epicor ERP environment whereby user accounts have been deleted and need to know who might have deleted or what could have triggered to delete the user account.

Is there a way to identify from Epicor what could have happened. We have identified the list of users deleted from previous backups and compared with the current backups and pointed to the actual day this event has occurred but still would like to know the root cause.

Any help is appreciated

My other major concern is how is Epicor allowing users to be deleted from ERP system that have got transactions and data passed against.

Any user having transactions passed should not be allowed for deletion rather should be allowed to disable only for the sake of history and audit.