I found 2 deleted invoice in 'User Action Logs', but it doesn't have a username.
See attached image.
Hello Syabab,
When the cronjob is executed, it will remove invoice (cleanup process) and during this period, the cronjob does not have a user account, so there is no way to relate the user account that is performing the action.