How can I determine which user triggered an update?
That one is tricky.

I can't think of anything that gets logged in Craft's log files currently that would help determine that.

We do keep track of the request IP address in all of our web service logs, so if you wanted to send the domain along with the approximate update time to support@craftcms.com, we could at least send over the IP address the update was triggered from.  That won't help much if the person was sitting behind a proxy/DHCP server, though.