A low-severity alert has been triggered emails

You need to investigate this a well, as that's why the alert is there. There are lots of scenarios where the users password is compromised and a malicious actor puts a forwarding rule on their account. You need to check every time you get this or other alerts