3 ms·An email activity anomaly detection will flag it immediately. That might have triggered the investigation.by bg24 6y agoAn email activity anomaly detection will flag it immediately. That might have triggered the investigation.