URGENT!! M365 Admins deleting email and Teams chat content

[techietab]

I've never reached out to any MS forums before, but I desperately need help please ASAP.  I am a M365 Admin with Global Admin access and am fairly new to PS.  I am currently investigating two M365 Admins with Global Access and the following activities I've seen:  

1.  One of the Admins went into my mailbox and deleted an email.  See the below script I tried to use to find out if this M365 Admin has ever had to my mailbox, under his name or otherwise.  I'm not sure what the results mean for this M365 Admin.  I see "NT AUTHORITY/SELF" below.  What does this mean, if anything?  Is the M365 Admin granting himself mailbox access under this generic "user" name?  

2.  I've noticed chunks of Teams chat content was deleted in my 1:1 chats and group chats with these M365 Admins.  Can someone please guide me to a PS script I can use to capture the deletions by these two M365 Admins?  

I thought I read somewhere that there is a file on the Admins PC that captures all PS scripts that person ran?  And what do you think of the Audit option in M365 Compliance?  I thought PS was more robust and would give the results I need instead of the Audit option?  

I need to know how to catch these two M365 Admins so I am open to all suggestions at this point.  If anyone has PS scripts I could use as a model, will you please share those with me?  

Thank you!  

[#2]

@techietab "NT AUTHORITY/SELF" represents the mailbox owner. So there's nothing wrong with this permission being set. You can run a "Non-Owner Mailbox Access Report" which probably gives the clearest info on if anyone but an owner has accessed any mailboxes.

As for Teams, administrators generally do not have access to delete 1:1 chat messages, unless they actually sign in under your account. They could set up a retention policy to delete chat messages, which would generally delete all chat messages after a certain period. They can of course delete their own messages if the correct messaging policies are set. There's generally no way to recover those unless some for of legal hold or retention is enabled.

[#3]

Thank you @pvanberlo I appreciate your quick reply!