created_by is getting another user assigned.

I have a user who says she entered 5 orders, but the created_by, last_updated_by all point to a different user.  They are not sharing logins.  I have not been able to find a pattern for this.  Sometimes the order is going to the person who is really entering and sometimes to another user.   The workflow jobs and subsequent jobs are all kicked off by the different user.  Nothing I can see is pointing back to the user who says she really input the order.

nothing is obvious.  any advice on how to troubleshoot?

 Thanks!