Yes. You need good logging on the vulnerable DB to trace the command - and if your DB is vulnerable it's a good bet you forgot the logging too. Emails have a b

Yes. You need good logging on the vulnerable DB to trace the command - and if your DB is vulnerable it's a good bet you forgot the logging too. Emails have a bunch of info in the headers, so there is more meta-data in the email it self. Neither is perfect for finding the culprit but one scenario has zero meta-data and the other has some.