Identifying which admin changed another admin's privileges
You may also be able to glean some info from the BSM audit logs. The log files are in /var/audit and are viewed with praudit(8). I don't know the format of the audit record for changing an account, but there should be some clues. You can check the date range and look for privilege escalations. The text section may have mentions of the '/Local/Default' node.