You may not be able to figure out who did it at the moment, but I suggest installing the plugin "CoreProtect". It will let you see which people break and place what blocks as well as repair it if necessary.
You can install this and wait to see what happens. You should be able to figure out the culprit and ban them. This plugin undos blocks, but not mobs. You can go into creative and replace the mobs until then (if your friends don't mind).
If your server is open, it may be an outsider. Do "/whitelist on" in-game and "/whitelist add [name]" for the people you trust. This will prevent other people from joining. If you do not have operator, go into the server panel and type "op [name]" to give yourself operator status. (It's basically singleplayer cheats but with more functionality).
Hopefully this helps
Marshland's post in Someone griefed us and i cant get to yesterdays logs to find their identity was marked as the answer