Who got root

Something on this Linux box escalated to root. Real admins use sudo all day, so that alone is not suspicious. But one account that should only ever run backups was added to the sudo group and then immediately ran a root shell. Read the auth log, separate the normal admin activity, and submit the account that escalated to root.