On the one hand you're saying it can't be done without some whistleblower turning up, on the other hand you think that its possible to happen accidentally.
It's kinda either/or. It's either possible that someone can get full admin privileges and deletes it off-the-record or they've got enough safeguards in place that the accidental deletion isn't possible either.