shutdown forensics

[Robin Becker]

I'm trying to figure out what caused an unplanned shutdown of a freebsd 
6.0 server; I see this in the last output

reboot           ~                         Thu Apr 24 06:15
shutdown         ~                         Thu Apr 24 06:10


but cannot see anybody having been logged in at the time. Is there any 
way I can trace the origin of the shutdown command?

I looked in the root shell history various other logs, but couldn't see 
anything obvious.
-- 
Robin Becker