Hi Jesus,
Yes, unfortunately, the audit module doesn't track deletions at all. Right now we sort of follow the typical patterns of relational databases - they can tell you about the current state of the world, but not what came before or how that state was arrived at. When something is deleted in AtoM, it's fully deleted, and no record is left behind.
However, I do think that all operations in MySQL are typically captured in the binary log - so you might be able to learn more there? This is outside of my expertise, so you'll need to look into online resources about MySQL to learn more about working with the binlog.
Similarly, I don't know for sure, but it's possible this is something you might be able to figure out by looking more closely into your web server's access logs. This is more likely to give you the IP of a user than the AtoM username, but this might still help you find the information you need?
Cheers,