You can check the default trace files for ErrorLog event class and you will find the statement:
<timestamp> spidXX  Configuration option 'Database Mail XPs' changed from 1 to 0. Run the RECONFIGURE statement to install.
The user name column will have the user.
It also gets logged to the SQL Server Error Log but won't have the user name in there. But you would look for the same statement that is in the trace.
In terms of auditing, it would be hard to send an alert when mail doesn't work so what we've usually done is have the alert setup through Windows monitoring tools, pretty much all of them can read the event logs and send alerts. It's logged to the Application Event log by default. The same statement:
Configuration option 'Database Mail XPs' changed from 1 to 0. Run the RECONFIGURE statement to install.
with the event ID 15457
Most of the times we've set this up they needed to do it by event id and source, depends on what it being used. 

Sue