Find out who ran a query using transaction log backups
Converting my comment as answer :

You have to use undocumented fn_dblog Begin Time, SUSER_SNAME([Transaction SID]) or fn_dump_dblog -- when reading from T-log backups. Be careful and try it on a NON PROD system as every time fn_dump_dblog is called, it creates a new hidden SQLOS scheduler and up to three threads, which will not go away (and will not be reused) until a server restart.

Also, its not that straight forward to be able to read T-log and come on a conclusion - If you have not done it or are new to it. You are better off trying a 3rd party tool (like Apex SQL Log) if it is that critical for you to find out who did the mess.