It takes some time and determination, but for majority of instances, when full logging is turned on, you can pretty much tell what happened in ULX and or server logs.
Or at worst, determine who was the worst of two aggressors and punish both, one more than the other.