Check out Paul Randal's article...

Finding out who dropped a table using the transaction log[/url]

Looks like this returns who ran the offending code:

SUSER_SNAME ([Transaction SID]) AS [User]