I believe you can determine this using MAPI properties in the Microsoft Exchange Information store. Out Of Office Assistant is simply a mailbox rule that is located in the User's mailbox. The rule is actually a hidden message. You cannot see any of this in Outlook or the Exchange client.
Here is what you can do:
1. Download Microsoft Exchange MAPI Editor from the following location. This is a Microsoft maintained tool for editing MAPI properties in various types of MAPI stores, including the Exchange Information Store.http://mfcmapi.codeplex.com/
2. Connect the MAPI Editor to the Exchange server that contains the mailbox with the Out Of Office rule. You would do this by going to the Session menu, and choosing Logon and Dispay Store Table.
I always do this with an Exchange admin account. I have to modify the account to have Send As and Receive As rights on the mailbox in question. The mailbox you choose in the profile creation wizard should be the mailbox you want to analyze. I also run this directly from the Exchange server.
After you connect, you should have the mailbox and public folders for the custodian in question listed in the top pane.
3. Double-click the Mailbox - Custodian Name in the top pane to open the Mailbox Root Container.
4. Expand the Root Container down to Inbox. Inbox is under Top of Information Store.
5. Right-click the Inbox and choose Open Associated Contents Table. This table should contain the hidden messages in the Inbox.
6. Find the Out of Office Assistant rule in the top pane and click on it (single click).
7. In the bottom pane, you should have the following MAPI properties:
You may have some others. If you are on an Outlook 2007 MAPI system, these properties will be a little different. PR_CREATION_TIME becomes PidTagCreationTime, for example.
Unfortunately, this is hardly a forensic process, since it must be done on the live system. You can attempt to restore a backup or an image of the Exchange server, but that's quite a bit of work.
<edit> I haven't tried this this with a PST file, but I would assume the procedure could work. The PST would have to be a complete export, including system data. </edit>
Hope this helps.