pstools/pskill - Use being logged?
Solution 1:
Check the Event Viewer on a machine that you suspect was shutdown remotely. You should be able to find a log of the Shutdown command being given and it might have the user who issued the command. You may need to tweak some logging to get that (I know Server 2k3 logs WHO sent the command, not sure about XP).