WordPress plugin silently activated or deactivated — who did it and when

One of the site's WordPress user accounts had not logged in for months. The person it belonged to had moved on. The account was, however, still attached to authored content and to assets managed by a downloadable-content plugin — and that plugin was running 22+ capability checks per minute against the user, asking whether the dormant account could still access its own files. The check rate looked like a humanly-active user. The user was not active.

The compounding problem is that dormant accounts with elevated roles are a standard initial-access vector. The site owner's first instinct, when asked about the account, was to defend the importance of the user's historical articles — the connection between "still has a role" and "still being asked permission questions about every minute" was not visible without the activity record.

The operator reassigned the historical content to a currently-active editor, demoted the dormant account to no-role, and rotated the password. The capability-check rate against that user dropped to zero.