Hello @rgilchrist !

Thank you for reaching us today and I am glad our plugin was useful in your troubleshooting so far!

Just to elaborate on what “Deleted user” means – that label appears when the log entry references a WordPress user ID that no longer exists on the site at the time you view the log. The event still shows the email it captured then, but since the original user record is gone or not attached to this site, the UI cannot link it to a current account, so it shows “Deleted user”.

A few educated guesses and a few suggestions which might help moving forward:

1. Does this happen on a single or multisite network? It might be that the account was deleted at some point (either manually, or through some automated process on your site?) and afterwards recreated under a new ID – since you mentioned you could find the user listed on your site.

NOTE: if this is a multisite, check if the user was previously removed from a subsite, but it’s still part of the network, which might explain the edge case situation.

2. You can check by ID 4007 which our plugin records when a user is deleted, that might as well help track down if / when the user was removed/deleted from the site.

3. Does this happen only for this user specifically or for others as well? That would also help in narrowing things down further, while checking what were the last activity records collected for each.

I hope the above helps; let me know how it goes!