How to check which user deleted an activeList?
For that you have to check internal ArcSight event:
In the following fields of the event you will have:
destinationUserName -> the user which deleted the object
fileName and filePath -> the name and path of your Active List
All the best,