You can get the user name and IP from the logs. You can tie the IP to a certain computer. Then you know the computer and user that were used to delete the files on the server. You won't see that in the logs (as you said), but you can tie them together using the commands that were mentioned earlier in this thread. You still won't be able to see who actually did it though.

Maybe you can somehow monitor network activity and see who's doing it. But you would have to come up with something to capture the event and make some kind of alarm go off, then quickly check who's at the computer. This means you would have to catch the guy in the act.

I would just permanently ban shared accounts. You won't catch the guy responsible, but you will prevent this from happening again. I know you said you're not allowed to change it, but still.

I just ran a small experiment, and the IP or Computer Name did NOT appear in my Object Access audit logs.   Only the user name was available. 

Here is what I would do:

1.  Make a business case why shared user accounts are ridiculous.

2.  If you fail at number 1, deploy some sort of host-based IDS to monitor sensitive directories.  (Tripwire, GFI, etc).

3.  Write something yourself.