You cannot find out who did it. As far as your account is concerned, it thinks you were the one who did it because all it knows is a valid sign-in was used.
If you were using security questions as your second level of authorization then probably somebody discovered not only your old password but also an answer to one of your questions. With two factor authentication, access to one of your devices or a trusted telephone number would have been required.
Read this document if you think your Apple Account has been compromised. --> https://support.apple.com/HT204145
Use the information in this document to check your Apple ID device list to find where you're signed in --> https://support.apple.com/HT205064
Related materials:
Personal Safety User Guide
https://support.apple.com/guide/personal-safety/welcome/web
> open the Table of Contents and review the articles
A document with general information about security and your Apple ID --> https://support.apple.com/HT201303
Contact Apple for help with Apple ID account security. This page provides country-specific Apple Support contact information ➞ https://support.apple.com/HT201232
Several years ago Apple transitioned to using two factor authentication instead of security questions. You can continue to use security questions if you already use them and they are working for you, but if you have problems then they no longer get direct support. Follow the instructions in the "Turn on two-factor authentication for your Apple ID" section in this support article --> https://support.apple.com/HT204915 to try to change to two factor authentication.
If you still need help, contact Apple Account support at this link ➞ https://getsupport.apple.com/?caller=cups&PGF=PGF63005
Select "Other Apple Account Topics", then "Security concerns or account compromised." This will give you a chat or telephone call option.