If there is Core Protect, they should find out who did it. Unless the logs has been cleared, the name of the one who removed should be there.