Hello! If the forwarder was created via the cPanel interface, you can check the access logs (/usr/local/cpanel/logs/access_log) to find when it was created. Entries that indicate forwarder creation will contain 'doaddfwd.html' so you could run a command such as the following to check which forwarders were created via cPanel:
grep doaddfwd.html /usr/local/cpanel/logs/access_log
The entries from the access log will contain the date the forwarders were created and the IP address of the user that created the entries, as well as the cPanel user they were logged in as.