During a threat hunt, an analyst reviews the domain controller Security log and finds Event ID 4720 (user account created) for an account named 'svc_backup2', followed minutes later by Event ID 4728 (member added to a security-enabled global group) adding that account to Domain Admins. No corresponding change ticket exists, and the account was created by an ordinary help-desk user. Which conclusion is BEST supported by these indicators?