Sorry I don't think you can trace it, unless you had some kind of auditing in place, especially if you don't know the exact time it was run.

I have seen this happening when someone used a script which included the drop and create permissions to restore a database, it then drops the role and permissions and creates them again, but the create only works for the database being restored not the other databases, thus in effect altering the permissions on the original databases.