In account compromission, multiples things should appear in the timeline like Attacker registered an MFA methods, or attacker registered a new device on behalf of the users.