Hey! The plugin called Core Protect would really work well for this situation. Unforntatly it doesn't show who placed it after you install the plugin. But this plugin should work, if you want to know how to work it just watch this video https://youtu.be/lZYShQtAe3E