Hi Heste,
I dont think so you will be able to trace unless auditing was enabled, you can check the permissions of the file/document and see what has access and work it through that way and check local devices logs but could be long process to trace, if you have proxy logs or network monitoring you can check the logs.
However it is not late to enable the logging if it is SPO and compliance reports are excellent way to audit and monitor. communication-compliance-reports-audits
==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.