Linking the audit logs, filtered for the user for the escalation timeframe will make it easy to see what operations have been performed.