You are right. The Moodle logs are limited. This may get fixed one day, but don't hold your breath.
There are also the web-server logs, but they may not include the user identities. They will include accurate time-stamps and IP addresses, which could be compared against the times in the Moodle logs.
Configuration changes on the admin screens are now logged, and a separate config log.