How is the user's home mounted? Are you using an automounter?

What files disappear? Old files, new files, all files, random files? One user, some users, all users?
If you can determine the rules by which files are disappearing and the time of the process, that will go a long way towards finding the process.
When you get close, you could create files using "touch" with timestamps a few minutes apart and use this to determine what time the process runs.

Is the danger time in working hours? Is the user logged in at the time? I'd certainly look at /etc/profile and the user's own Shell profile.

One blind guess would be to look for a script running from cron at around the right time which contains a "find" statement on /users where the username parameter is not set. Similarly look through /etc/passwd for an account with home directory of /users (I've seen this one cause havoc before).