Ok if i remember correctly the logs log everyone by their unique user ID and their current player name, copy all the log files in question into one folder and if you have something like the admin mod that brodcasts a message out to the server, and your logging amount is turned on so it will record this, then

if your in windows you can do the serach function and look for text in side the files, specifically his wonID.

or you can open up the files and do a serch for his wonid on each file.



Then again that might take a while if he plays there a lot and you have a lot of logs to look over, you might try seraching for the string (the exact words, exact letters, commas, exactly what admin mod says) that the adminmod brodcasts when it kicks someone for cheating.