We ran into a rather bizarre situation. On one of our database instances somebody changed two log shipping databases from Full backup to simple backup. This caused log shipping to break. We have no idea who or why the person did this. Following this we tightened security and changed passwords but I still would like to know who did it and why. Any thoughts on how to figure out who was the culprit.