Are you able to advise if there is any way how a user was deleted off a terminal? Be it from the terminal, from web portal or via sync options?

Please Login to device's [Authentication/Log Setup] page to enable the "User and Audit Log" function. 

     After that,in the future,for any add/delete User log entries will now be logged,and also can be seen from the device's [View Event Log] page so that the admin user can understood who is the "ghost employee" if any.See the below as an example.