Second that.  The security log will show who delete what file at what time. That's the best evidence. Then send a personal email to the culprit with the screenshot attached, says "dont ever mess with your system administrator".