How to know who restarted and what caused SQL Server
What about setting up a server audit with this event : "Audit Server Starts and Stops Event Class" > "The Audit Server Starts and Stops event class occurs when the Microsoft SQL Server service state is modified". Never tried it, but you should be able to knwow which "LoginName" modified the SQL Server state. "EventSubClass" 1 is regarding shutdown.

https://msdn.microsoft.com/en-us/library/ms189244(v=sql.100).aspx

https://msdn.microsoft.com/en-us/library/cc280663(v=sql.100).aspx