User record updated unknowingly

[servicenow_devo]

Hi, I was having a visitor user record in user Table which is used for incident creation through inbound email. The company field for record was empty previously seems like now company updates to some value.

I have enabled audit log but no history for company modified.

Through incident record created by this profile I could see company was showing 3different name for same profile for last 3months. But no history is showing on user profile.

Can anybody help what else cause and what how we can figure out what has updating the user profile.

My customer wants to control the same without updating any user record. Issue was with only visitor profiles.

[Tony Chatfield1]

Unfortunately the community does not have access to your instance and so cannot see your configuration, or evaluate it's impact. If a value for an audited record is being changed then I would expect to see the change recorded in the records audit trail\history.
Perhaps the issue is that import data is being loaded with the wrong company set, or with other values set that cause the company to be changed?

[servicenow_devo]

Hi thanks for all you replies.

I have checked in all possible ways to figure out the cause. 

Profile data source for respective profile is showing as manual data entry.

I dont think it have link to data load. 

As I have mentioned no audit logs are available related to change in company field.

All other changes are recorded no changes recorded for this field change.

[Tony Chatfield1]

If you look at an xml of an impacted record the sys_updated_by field should indicate who last changed the record - unless it was changed by a script that included autoSysFields(false).