If I append &xml=T to the URI of the sales order page I can see an XML element called recordcreatedby, which contains a value that seems to be the internalid of the user that created it