I hate to disappoint you, but it is not necessarily a good assumption that in MSP "all or most user actions are logged somewhere". There IS an OPTIONAL Audit Logging feature that can be turned on that allows MSP to logs MSP Console UI User actions that result in Jobs being sent to devices.  But that only relates to "scheduled" actions and only at a faily high level.  It would not likely tell you if the end result of some action did or did not result in the removal of a folder, unless you delved into every detail of every logged action.  Further, Audit Logging does not log ANYTHING that happens through Remote Control, if you are using that.  Nor does Audit Logging log anything that is done by applications on devices. Honestly, while it is not impossible that MSP might be able to log something that might indirectly lead you, given enough sleuthing, to uncover the cause of a folder being deleted, it is far more likely that it will not.