Does your software date stamp the change in settings? If it does, you can take note of when these changes were implemented.
It would also be nice to know who was accessing the system config during those times.
Find the time, find the man logged in and you will find your culprit. End of problem.