1. You can go to UDP Console > Log and search for the message - delete.
2. Also, you can also check arcapp.log (Location : C:\Program Files\Arcserve\Unified Data Protection\Management\logs\)
You can check who logged into the UDP Console before deleting the node. Hope this information is helpful.
2018-03-29 11:04:22,427 http-nio-8029-exec-20 [INFO] SSO login successful, username is Administrator
2018-03-29 11:04:48,308 http-nio-8029-exec-3 [INFO] username which get from session is Administrator
2018-03-29 12:06:36,128 http-nio-8029-exec-1 [INFO] [NodeserviceImpl]deleteNodeInternal() Begin to delete the node: windows-xxx the node id is: 1
2018-03-29 12:06:41,577 http-nio-8029-exec-1 [INFO] [NodeserviceImpl]deleteNodeInternal() Delete the node: windows-xxx finished, the node id is: 1