I'v dig much deeper and found more clues:
After scanning of our nginx acces.log files 8 x ~50GB I found IP which was active at http://ci-wiki.wikidot.com/_admin at this particular day, than grep for particular time of accident:
TeRq ~$ cat ci-wiki_28-Mar_admin.log | grep 21:27 | grep -v www.wikidot.com | sort
73.8.237.150 ci-wiki.wikidot.com - [28/Mar/2015:21:27:11 +0000] "GET /common--images/301.gif HTTP/1.1" 200 35269 "http://ci-wiki.wikidot.com/_admin" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0"
73.8.237.150 ci-wiki.wikidot.com - [28/Mar/2015:21:27:11 +0000] "GET /common--images/top-bar-logo.png HTTP/1.1" 200 3961 "http://ci-wiki.wikidot.com/_admin" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0"
73.8.237.150 ci-wiki.wikidot.com - [28/Mar/2015:21:27:12 +0000] "POST /ajax-module-connector.php HTTP/1.1" 200 6162 "http://ci-wiki.wikidot.com/_admin" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0"
73.8.237.150 ci-wiki.wikidot.com - [28/Mar/2015:21:27:17 +0000] "POST /ajax-module-connector.php HTTP/1.1" 200 1219 "http://ci-wiki.wikidot.com/_admin" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0"
73.8.237.150 ci-wiki.wikidot.com - [28/Mar/2015:21:27:17 +0000] "POST /ajax-module-connector.php HTTP/1.1" 200 1361 "http://ci-wiki.wikidot.com/_admin" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0"
73.8.237.150 ci-wiki.wikidot.com - [28/Mar/2015:21:27:17 +0000] "POST /ajax-module-connector.php HTTP/1.1" 200 663 "http://ci-wiki.wikidot.com/_admin" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0"
73.8.237.150 ci-wiki.wikidot.com - [28/Mar/2015:21:27:18 +0000] "POST /ajax-module-connector.php HTTP/1.1" 200 12524 "http://ci-wiki.wikidot.com/_admin" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0"
73.8.237.150 ci-wiki.wikidot.com - [28/Mar/2015:21:27:24 +0000] "POST /ajax-module-connector.php HTTP/1.1" 200 116 "http://ci-wiki.wikidot.com/_admin" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0"
73.8.237.150 ci-wiki.wikidot.com - [28/Mar/2015:21:27:24 +0000] "POST /ajax-module-connector.php HTTP/1.1" 200 1444 "http://ci-wiki.wikidot.com/_admin" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0"
Actually only this IP was active those day at ci-wiki _admin and it seems to be a static assignment (http://whatismyipaddress.com/ip/73.8.237.150)
Two ajax actions was performed in same second that ToxicClay was promoted to mod.
73.8.237.150 ci-wiki.wikidot.com - [28/Mar/2015:21:27:24 +0000] "POST /ajax-module-connector.php HTTP/1.1" 200 116 "http://ci-wiki.wikidot.com/_admin" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0"
73.8.237.150 ci-wiki.wikidot.com - [28/Mar/2015:21:27:24 +0000] "POST /ajax-module-connector.php HTTP/1.1" 200 1444 "http://ci-wiki.wikidot.com/_admin" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0"
ToxicClay PM from database:
SELECT date, subject, body FROM private_message WHERE to_user_id = '348811';
date | subject | body
---------------------+----------------------------------------------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
... <part only>
2015-03-28 21:27:24 | Added to moderators | +
| | +
| | <p>You have been added to moderators of the site <a href="http://ci-wiki.wikidot.com/">The Chaos Insurgency</a></p> +
| |
...
Then scan for events at log_event table:
SELECT * FROM log_event WHERE ip = '73.8.237.150' ORDER BY date;
event_id | date | user_id | ip | proxy | type | site_id | page_id | revision_id | thread_id | post_id | user_agent | text
----------+---------------------+---------+--------------+-------+-----------------------+---------+----------+-------------+-----------+---------+------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------
... <part only>
42634182 | 2015-03-26 23:24:48 | 1932258 | 73.8.237.150 | | POST_NEW | 66711 | | | 1157442 | 2258465 | Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 | New post "" has been saved on site "SCP Foundation".
42634196 | 2015-03-26 23:26:14 | 1932258 | 73.8.237.150 | | POST_NEW | 623373 | | | 1063633 | 2258467 | Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 | New post "Re: Staff Post - Open" has been saved on site "The Chaos Insurgency".
42641335 | 2015-03-27 12:16:44 | 1932258 | 73.8.237.150 | | POST_NEW | 66711 | | | 1157662 | 2258663 | Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 | New post "" has been saved on site "SCP Foundation".
42648013 | 2015-03-27 22:39:34 | 1932258 | 73.8.237.150 | | POST_NEW | 66711 | | | 1158253 | 2258927 | Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 | New post "Re: /scp/- an imageboard for us all" has been saved on site "SCP Foundation".
42649673 | 2015-03-28 01:09:15 | 1932258 | 73.8.237.150 | | POST_NEW | 66711 | | | 1158253 | 2258959 | Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 | New post "Re: /scp/- an imageboard for us all" has been saved on site "SCP Foundation".
42651251 | 2015-03-28 04:00:34 | 1932258 | 73.8.237.150 | | POST_NEW | 66711 | | | 1150543 | 2259005 | Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 | New post "Re: THE FINAL FOUR AND CHAMPIONSHIP RESULTS!" has been saved on site "SCP Foundation".
42660026 | 2015-03-28 21:35:45 | 1932258 | 73.8.237.150 | | POST_NEW | 643529 | | | 850584 | 2259464 | Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 | New post "" has been saved on site "Falchion Valley".
42661006 | 2015-03-28 23:09:46 | 1932258 | 73.8.237.150 | | POST_NEW | 643529 | | | 860730 | 2259500 | Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 | New post "Re: To: Moderative Staff" has been saved on site "Falchion Valley".
42661593 | 2015-03-29 00:18:31 | 1932258 | 73.8.237.150 | | PAGE_EDIT | 643529 | 22057325 | 52929853 | | | Mozilla/5.0 (Windows NT 6.2; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
...
And all this leads us to one user_id 1932258 which particularly belongs to:
wd=> SELECT user_id, nick_name, unix_name FROM ozone_user WHERE user_id = 1932258;
user_id | nick_name | unix_name
---------+-----------+-----------
1932258 | Heartful | heartful
(1 row)
Hopefully this ends our conversation at Wikidot's end issue in this case.