Completed an investigation and discovered a compromised user account. We reset the password and revoked all sessions, and recommended strongly that the customer upgrade their entire tenant to Entra P1 and implement Entra P2 licenses for VIP users.