Is it possible to track down when and by whom customer contacts were changed?
At first, please go
Top > Account Director > Customer Manager > Customers > Customer in question > Contacts tab and check the version date. That will answer when contacts data were changed.
/var/log/hspcd/access_log for the date discovered for entries like
192.168.1.2 - - [02/Aug/2015:03:14:34 +0700] "GET /cp/index.cgi/account/contacts/sl,acc_contacts_upd_ok HTTP/1.1" 200 6705 "https://184.108.40.206/cp/index.cgi/account/contacts" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0 AlexaToolbar/pNJuBjJf-2.1"
The one above shows that contacts were updates from CP (220.127.116.11 is OBAS server IP address) by someone who logged in from the IP address 192.168.1.2.