Hi,

is there anything suspicious in syslog around the time of the reboot? If there's no user to blame then I would suspect something relevant in /var/log/messages.

Regards,
Eugen