Could you look in your admin_activity_log ... this should give you the movement through the Admin when this was done ...

Maybe it can help locate a pattern in there?

Thanks for the update ... still cannot repeat it myself either ...