Unusual Activity for a User

Hi,

I have an issue with a user who raised a query that they are having issues syncing files to SharePoint.

Whilst I'm investigating this another query came in advising that this same user has been creating folders and uploading documents......

They have confirmed that there account has not been shared and can confirm from the signing in logs on Entra that no suspicious IP address is being used.

Anyone have any idea of what is occurring??

I've advised the user to delete any links they have and stop syncing.

Regards

Chris