I get that you're reluctant to punish kids who are definitely innocent (the cousins who weren't there) or probably innocent (your kids and the two girl cousins) in order to punish the one who probably isn't. But at the same time, I think you have to show that bad behavior has consequences.
It's not your fault that exSIL makes her three kids come as a package deal. If the two girls suffer because of something their brother has done, maybe they will put pressure on him to behave better in the future, or pressure on their mom to break her unfair arrangement.
And actually, the punishment of canceling the next few sleepovers will show all the kids that you mean business. They've all been well-behaved before; that's great. But this will show them not just that they get privileges for being well-behaved, but that they will get punishments for being poorly-behaved.
Personally, I would change the birthday party to a non-sleepover. I think you have a good reason to change the conditions of the party, given that something bad happened at the exact same kind of gathering so recently, and more importantly no one has owned up to it. Obviously you would need to contact all the parents right away and let them know, in case their own plans have to change (coming to get their kids that day rather than the next, for example). And you would understand if some of them had to cancel because of this.
Again, it's not you punishing your son--it's you showing all the kids that there are consequences for mischief and lying. And the lying, specifically, means that the consequences are broad across everyone, rather than being focused on the one person who actually caused the mischief. So next time, kids, don't cause mischief; or if you do, at least don't lie about it, because then everyone suffers for longer.
