Missing PM - How to ID Root Cause?

[silurius]

I have been looking into a mystery and was hoping I could get some advice here. On a 3.6 forum a little while back, a user complained that her account had been compromised and that a certain private message had disappeared. Knowing this person as I do, I have no doubt that what she says happened did indeed happen, but I also know that vBulletin doesn't log that sort of activity (at least, I remember reading that it doesn't). I realize that there are hacks out there to address this should it happen in the future, but I am motivated to get to the bottom of this particular event, even if it was isolated.

Is it possible to run a grep command on the server, using some string with "private.php" in it, or something along those lines? Am I being too hopeful? I realize there could be an exhaustive amount of data to pour through, but I have reason to be totally OK with that. Whatever it takes, I'm willing, so long as there is potential.