She had wiped the Windows Event Viewer logs off of a PC.
In a typical corporate setup, the event logs are archived by size, which creates an archive file. So before you confront somebody, about something you admit you know very little about, you might want to check the configuration of the machine. This same functionality can rotate logs, so an archive is NOT created, which means older events would eventually be overwritten by more recent activity.
I’m not an IT person so I’m not sure but we want to make sure that we give her a fair chance at explaining her actions when she returns to work.
Based on this statement alone, you shouldn't confront the security analyst in question, because it appears you are unfamiliar with how the system is actually configured. As an Administrator myself, If somebody came to me who in their own words, describe themselves as "not an IT person" I would go to their manager immediately and make sure they are disciplined.
If another Administrator came to me, I would explain my actions and would move on with my life. As an Administrator, there are numerous situations, where cleaning up the events that have been logged would be acceptable behavior.