You could turn on the accounting facility to do that. For Tiger, first you need to set it up. At the terminal:
sudo mkdir /var/account
sudo touch /var/account/acct
To start logging what programs are run, the command is
sudo accton /var/account/acct
To stop logging:
sudo accton
To see what has accumulated in the log, you can use the lastcomm command. Entries are added to the log when programs quit. Carbon apps may only be logged as "LaunchCFMA".
The above won't really tell you what someone did, but it will let you know what was launched.