I don't think we log anything specifically that would indicate that. I was going to suggest looking at the moderator log, but unfortunately we only started logging moderator performed warning expiry and deletion there starting with XF2.
In the xf_warning table itself you have the date the warning was issued and the date the warning was expired and whether it is expired or not. There isn't really anything in there to distinguish between warnings which were expired early by staff, expired naturally because the expiry date passed etc.