Guest update option WordPress Address

This is a line from my audit log

Guest update option WordPress Address (URL) from https://mysite.com to https://guestsite.com/m99935473; Guest disabled site registration; Guest update option New User Default Role from administrator to subscriber

Someone went in my multisite and changed all the site urls in the database. I had to fix the database first.

I see a bunch of these too:

Guest update option New User Default Role from subscriber to administrator