In tenants with multiple administrator user creation and deletion can be performed by any of them. You can pinpoint the one that performed the chance using the 'Audit Log' to search for by 'Action'.
Solution:
1. Log in as an administrator user
2. Navigate to 'Configuration' > 'Audit Log'
3. Fill in these search form fields:
a. Time Range: set the range to cover the period of time the change was made
b. Resource Type: select 'User'
c. Action: select 'Created' or 'Deleted/Trashed'
4. The log will display a list of created/deleted users(e-mails) and the name of person who performed the change