You could try looking at your transaction log backups, and see what time of day they were very large. Then try to figure out what was running at that time.

I keep 30 days of server side trace files, so I can look there to see what was runnng at a particular time.