hi ,
you can use fuser filename to see if file is in use it will
give you process id where you can check using ps -ef | grep process id to see who is using it
You can use istat command ( man istat) istat filename
to show you when it was last modified
if you have the HISTFILE variable set in your .profile
you can check users history to see if any one vi'ed , / changed your file.
HTH