From looking at /etc/e-smith/events/restore-tape/S10tape-restore-flexbackup, it looks like restore messages would be in /var/log/messages and/or /flexbackup.extract.log (note: not in /var/log).
I've seen systems magically revert by several months as you describe twice - once due to a user running the pc vendor's "system restore" function at boot (HP/Compaq had an option on some workstations for a while that displayed "press F11 to restore" at every boot, but never actually updated the backups), and once due to a failed raid array (the array failed and the user didn't notice, 6 months later the "live" drive died, and the system booted from the "failed" drive that had old data on it).