I have been able to deduce from seeing other activity by logins with sa privileges around the time of a given event.

E.g. tempdb object creation or worse yet sort warnings.

All it tells you is that a given login from a given server was active at a certain time.

Presumably a small list of logins has the ability to delete data.

I have found the culprit causing slowness at a given time, by finding sort warnings related to certain sessions.

All I am saying is that you can come up with a list of people to ask if you get lucky.