Recommended steps after a user login alert?

Hi – I received an email alert that an admin user logged in to our site from an IP address in another country. Do you have a checklist or recommended steps we should take when we get this WordFence alert? I immediately deleted the user account (it was an inactive one that should have been already deleted) but I don’t know if that terminated their session. I ran a WordFence scan. I didn’t find any suggested steps in the WordFence documentation. Thank you.