Someone may have a more clever solution, but to my knowledge sys_audit is the only place you'll find that information, and it wouldn't be quick. Queries against sys_audit would have to be done one Incident at a time using the sys_id of each Incident, which is stored in the documentkey column of sys_audit, and looking for sys_audit records where sys_created_by is the username of the person you're interested in.
If the query returns any records, that person updated the Incident.
But that's not all, since inserts aren't audited by default. You'd then look at the sys_created_by of the Incident itself to see if the person created it. Come to think of it, do that before querying sys_audit. If they created the Incident, you're done for that Incident.
