Someone ran a query that pulled a lot of data and put an order by on it (or something that required a sort). SQL attempted to sort, split the sort to TempDB (sorts are very prone to spilling because of the sheer volume of workspace memory they need), the sort filled TempDB, caused the query to fail.

You'd need to identify who was running what. Unless there was some auditing or tracing already in place, SQL won't have a record.

I'd speak to anyone that can run custom queries, see what they were doing.