We have a bizarre situation where a mysterious Automated Process is making mass changes to contact names and addresses at random times. We have done all sorts of troubleshooting, debug logs, disconnection of external apps, uninstallation of apps, etc and cannot get to the bottom of it. We don't have Salesforce Premier support.
One strange detail: Field History Tracking says the edit was done by Automated Process, but the record's Last Modified By always shows an actual User. In most cases the real person is not even logged in at the time of the change.
We are now considering drastic actions like this: Freeze all users except one sys admin, then slowly unfreeze users one at time until the problem recurs, then deactivate that culprit user and create a replacement.
Setting aside the basic insanity of this, would it work to stop the Automated Process? Would the changes fail and rollback due to the frozen users?