Thank you both! Using a combination both your methods, I was able to determine when the change was made, and from which user account. Looks like it was user error after all!