How to retrieve log of new account access approvals

[MS]

My client's Google Ads account has been compromised. Someone must have granted administrative access to an alien account.

I'd like to perform forensics on who approved that alien account and when as we may need to take legal measures on that person.

How can I do that? What's the GAQL query for retrieving such log?

Your answer is appreciated.