You can create an alert based on an event set configured for the 'shutdown control: query result' which would show what action the administrator took when prompted "does he really want to shut down the service". I don't see an option off-hand to see when the administrator started the agent service. You can always double check by when the last time the agent has polled in.
I can't help you with the other issue.