Good morning,
I just wanted to ask if anyone could shed some light into the issue.
My moodle installation is version 3.11.1
Staff reported that their account mass enrolled 400+ users into a course without doing anything, confirmed this through the system logs.
They were checking the user list of the course last, then 400+ users were mass enrolled.
This is also not the first time this happened, was wondering if there's a bug or if the account itself was compromised, though I do doubt the latter since the IP was still using my staff's IP address.
Thank you!