Sorry to hijack these comments but would like to ask the crowd here if they noticed these two phenomenon about Search-MailboxAuditLog, particularly in my case for Shared mailboxes, but I'm not sure that has any bearing on the issue.
1.) When you use Recover Deleted Items (i.e., items are in the RecoverableItems\Deletions folder), the audited Operation is "HardDelete". My assumption is that anything that leaves Deletions is expected to have gone to RecoverableItems\Purges, which is an oversight of the Recover Deleted Items feature which moves the item(s) out of Deletions and back into the user-visible original location or Deleted Items folder.
2.) When a FullAccess-granted user (via AutoMapped mailbox in Outlook) drags an item from one folder to another (i.e., what we would think is a Move), the audited operation is "SoftDelete". In this case, it's not the same as a true "SoftDelete", which is what always happens when an item is deleted by the user, since the deleted item has to leave that Shared mailbox and go into the user's own Deleted Items folder (hence the audited operation in that case is not what we might expect, MoveToDeletedItems). In this case the item is not in any mailbox's Deleted Items folder, nor Deletions, it is in the drag destination folder. I thought this odd audit behavior might be masking that dragging is a copy then delete original, but I can't seem to prove this.
Anybody else ever observe this?