Just from the serverfault.

In the System event log, filter by event id 1074, this will show by which process and on behalf of which user a reboot was initiated.