Exchange contacts being mass-deleted
We have one user who has had a large portion of his contacts move to his recycle bin. The first two times it happened in the middle of the night and a thousand or so contacts were deleted within a minute. This weekend, he had over 2000 (of his 3,400) contacts deleted over the span of two hours. All have been restored from his Deleted Items, so no data lost, but we do need to get to the bottom of the mystery. These large groups of contacts are not consecutive, so it's not like he shift-selected a bunch and manually deleted them. The first two times this happened, over a thousand random contacts were deleted in under a minute, which doesn't seem possible to be human error. This last time he was out of town and not using his laptop, but was using his iPhone. When we search his deleted items, we see the deleted contacts, but no deleted messages or calendar items in the same timeframe. Our environment is Exchange 2013 on-prem (DAG), Windows 10, Office 2016, iPhone and iPad. We have checked Outlook add-ins, mailbox delegates, Outlook rules, and retention/archiving policies. Has anyone ever seen anything like this? Any ideas on how to investigate what process or machine is deleting the contacts?