Like Prashant said, audit logs are the best way. If you know the deletion happened via the website, you could also sort through the iis logs and look for a POST (not a GET) to
That should at least narrow down a list of users who have made some type of change to the permissions on the site.
Another thought is to write a query to the ChangeLog
This is assuming not so much time has pasted since the event so the event will be in the changelog. By default entries in the changelog expire after 60 days (http://msdn.microsoft.com/en-us/library/bb417456(v=office.14).aspx).
When auditing first came out in SP 2007, I wrote a feature that automatically turned on auditing for every existing site collection and when a new one is created. You might should look into something similar if you need to support these type of questions in the future.