I am verifying the information you have supplied; however I know that the export of the history commands was done as part of our analysis to investigate how the files were deleted. You should also see other members of my team trying to establish that as they were all trying to work out where the files had gone.
Secondly, the RM command for 1118 is the deletion of the dump files which are copied over from SIT and put in a dated file. This is not the deletion of the source code. Also RM removes the files not the directory, so whilst the files would be gone the directory would still be there.
More to follow