The phrase "by whom" is a formal and grammatically correct way to ask or refer to the person who performs an action when following a preposition like "by." It uses "whom" because "whom" is the objective case pronoun, used as the object of a verb or preposition. For example, in the question "By whom was the book written?" "whom" is correct because it is the object of the preposition "by".
In everyday spoken or informal English, people often use "by who" or place the preposition at the end ("Who was it written by?") because the "who/whom" distinction is becoming less strict in common usage. However, from a formal grammar perspective, "by whom" remains the proper choice when the preposition comes first.
A helpful tip to decide between "who" and "whom" is to replace the word with a subject or object pronoun:
- If you can replace it with "he" or "she," use "who."
- If you can replace it with "him" or "her," use "whom".
Summary:
- "By whom" = formal, correct; used when "whom" is the object of "by."
- "By who" = informal, increasingly common but less grammatically correct.
- When in doubt, "by whom" is safer in formal writing and speech.

