[Isias]

If he disabled RCon, then there still should be log files prior to him gaining RCon access. It would be really necessary to have a look at the commands used prior to him gaining RCon access and to get some more informations about your server, especially if you've set sv_cheats 0 in your server.cfg and what plugins are running.