Well this is not possible, however at the hand of the start time you have a rough estimate when the person likely walked away after his/her action.
Inside the kernel logs this start time can be found, just login via luci in the advanced settings and then under status -> log you can find it.
It is possible the time is in milliseconds, but miliseconds can be converted to dates with time, you just need to find a way to convert it (I know it is possible by programming, but i'd guess there must be web based generators).
If you restarted the router again, not possible.
Wether to be able to read in the logs if a person did it vs something unknown like /overlay issues with ext4, thats also not possible, only by observation.
I'm not sure if there's any logs you can check but you could view the system uptime overview to see if that looks less than what it should, I suppose that would give a little insight to see if it's possibly been reset.