There's no way to find out which role allowed a user to access a transaction code in the past. That information is not held anywhere. You say no changes have been made to the user, so that must mean changes have been made to one of the user's roles. Look at change documents for those roles.
Steve.