The specific Virtualmin action that was performed can be found in the VIRTUALSERVER_ACTION variable, such as :

CREATE_DOMAIN
  A new virtual server is being created.
DELETE_DOMAIN
  An existing virtual server is being removed.
DISABLE_DOMAIN
  A virtual server is being temporarily disabled.
ENABLE_DOMAIN
  A virtual server is being re-enabled.
MODIFY_DOMAIN
  A virtual server is being updated, such as when features are added or removed, or ownership is changed.
CLONE_DOMAIN
  A virtual server is being created by copying an existing server.