For a) you want to take a look at the default trace. That's how you can tell who made structural changes to the system.

As far as b) goes, if the user is still there, the jobs are running under that security context since that user is the owner. I don't know what would happen if you deleted the user. I suspect the job would fail.