When a model is destroyed, the 0x10202 event is logged. This event displays the user that destroyed the model:
| || || || || || || || |
|Aug 25, 2015 9:35:47 AM EDT||spectrum.ca.com||A model has been destroyed. The model was spectrum.ca.com of type Host_systemEDGE destroyed by user1@user1system.||user1@user1system||0x10202|
This can be seen by selecting the landscape in the Explorer tab of the Navigation panel and then click on the Events tab in the Contents panel. Click on the Filter icon to set the start/end date/time for the range and set a filter for the 0x10202 event.