Check the log files, they will tell you the answer.
Some quick questions to ask yourself to give you some pointers:
1. Does all VMs that are shut down, reside on the same host, or on several hosts?
If on several then you are more or less guaranteed that it was initated from the vcenter, then check vcenter logs
2. If the event lists shows a user initiated shutdown, you are guaranteed its a user error
Tip:
Limit user access using the folder structure and set rights within the folder the user/group really need access to, and let them be read only for the rest.