It sounds unexpected but it’s true, comment-only users, whether they are a member or a guest in your organization can delete attachments without anyone being notified 
.
What’s even worse is that it doesn’t even show in the task activity log 
…
Upvote to get that changed 
