You can check the mailbox.log file. It will have messages like the following:
2013-05-08 14:03:22,066 INFO [btpool0-18599://zmail.newpaltz.edu/service/soap/MsgActionRequest] [name=REDACTED@zmail.newpaltz.edu;mid=3;ip=REDACTED ;ua=ZimbraWebClient - GC24 (Linux)/7.2.0_GA_2669;] mailop - moving Message (id=579351) to Folder Trash (id=3)
You can look for the IP & client type responsible for the move to the trash. You should also check the users filter rules to see if they created an incorrect rule (something which is moving all mail instead of certain mail to the trash). Once in a blue moon I'll have a user create a rule that is supposed to be two conditions with a boolean AND (i.e. from one sender and with a certain subject) but they make a mistake and leave it with the boolean OR matching more than they intended.