I don't know of a more complete answer, but...
You can try
inotifywait -mr --format '%T: %w %f %e' --timefmt '%c' /
The only downside of this is that I know no way to show the user name. However, maybe you can use this in conjunction with the shell history to determine the guilty
You can change the directory, or even launch multiple monitors for many dirs if you want. You could very well redirect that to a log file (>) so you can review it later or use it for forensic purposes.
I'd be interested as well in a better solution, but for now I know none.