Welcome to the beta experience of the SailPoint community. Pardon our dust! Learn more
Do you have an account activity for this transaction? If so, it might have a section for IdentityNow which may contain some clue around this.
Have you tried looking at the access history to find these details? You should be able to see all of these changes through the access history.