Audit log showing Application administration activity for a standard user

Summary:

Every month we send a copy of the audit log to the finance team for review and discussion - we also supply them with a script to annotate the log (so its easier to read) and when updating the script for report auditing I've noticed that in the exported log we have an odd/concerning entry.

Content (please ensure you mask any confidential information):

The event looks like this:

They weren't the first user of the day and they weren't actually doing anything else around this event. The old value according to the log is blank. Any ideas how it can be explained? (this user has never been admin or a power user). I'm not even sure where this setting is changeable in the config. Any help would be appreciated as I will need to explain to the Finance team what the entry at the end of May. I did wonder whether it relates to a form. Note the log is exported using EPMAutomate and e-mailed directly to the