You don't specify whether this is a data pump export or a conventional export. If data pump then the file is created at the OS level by the server process and hence the owner of the file will always the software owner (i.e. "oracle").
Best way to track it would be through auditing. Regular auditing will show you who's accessing the objects. And you can correlate back to the OS user from auditing the CREATE SESSION event.