How to Identify the user who issued MySQL Shutdown command
Check the secure log in the event it was run via a sudo service call

sudo grep mysql /var/log/secure


Check to see if there's any mysql related stuff going on in cronjobs

sudo grep mysql /var/log/cron


Check shell histories for mysqladmin calls

cd /home; for u in *: do; sudo grep mysql /home/$u/.bash_history; done

Check with people you know that either have sudo or mysql root access on this machine

"Hey, which one of you has been shutting down mysql?"