Hi @RobinKouvaras,
I agree with @mzimmerman that there's really no audit trail in Canvas for this kind of thing. However, if you have a small number of administrators or a suspicion about who made the change, you could check the page views for each of those users to see if any of them visited the theme area ({canvas_url}/accounts/{id_number}/brand_configs) around when you suspect the change was made. There is little reason to go to that area unless a change is being made, so I suspect you'd be able to track down who did it with this method, unless you have a lot of admins and it would be too much time to search each one.
-Chris