Activity Log: Missing Login Entries

I'm working with a user whos site was deleted by a rogue employee yesterday. Luckily, we were able to help them restore the site and get things sorted out. The user is back today though asking if we have any logs showing that the site was deleted and if they have an IP address attached to them. I think they are trying to gather proof or evidence for legal action against that employee.

We pointed them to activity log which typically shows the login for the admin users as follows:


However, when we look at the activity for the user that deleted everything it appears that some of the entries were missed by activity log, such as the login for the user that deleted everything:


So here are the questions we have now:

1) Any ideas why there are missing items?
2) Do we have an IP address for that user login and can we provide it to the user?

#9821099-hc #1748926-zen

No source file, test, or entry point is named; start by locating the activity log implementation and the code that records admin logins. Compare the reported missing entries with the screenshots, then document whether login IPs are stored and whether the log can reliably expose them.

Written by the indexing model from the issue text.