The audit trail does not seem to give any clue. It shows the users logging in, no problem. It shows where I updated the pages under posts, but nothing for other users who only have editor privileges. It is interesting, under Emails. One of my editors, Kelly, has this posted:
There was an attempt to send an email using the “wp_mail” function. It was sent to “[email protected]” with the subject “Firewall Block Email Alert: https://southforkpub.com”.
My web host, Rush Graphics likely has that set up, however we really don’t use any email on this site. Also, the date and time of the above message is about four hours AHEAD of where my current time is?? My computer system time is correct.
Thanks for helping with this.