What evidence is there that someone with physical access to the server rebooted it?

There are many fewer people with physical access to that machine than remote access.