Well, what I'd do first is enable the recycle bin function of CIFS. When stuff gets deleted it'll go in a folder with the user's name. So if you mapped /mnt/zpool/data1 with the username gearhead and the file test.txt is deleted you'd see the file get moved to /mnt/zpool/data1/.recycle/gearhead/test.txt.
If you setup 2 users and map them that way you can identify which one(or both) is deleting what.
But in all honesty, I'm totally not buying that your FreeNAS server is deleting stuff on its own. Your client could be encountering an error and deleting/overwriting the file or something. But I think there's no chance at all that your server is willy-nilly deleting files. That's something that would be noticed very quickly with the size of our userbase.