After scrolling through the audit log in Defender I noticed that the guest has quite some activities. However it’s not a guest it’s WPMU. Either on sending a lockout mail or adding minified files from Hummingbird. Perhaps it’s possible to set a label for WPMU activity, Instead of “Guest added new [whatever]” it would be “WPMU added new [whatever]”. It’s not a critical request but just thought it would look better and also easier to look through audits.