User reports Microsoft Authenticator prompt 'ROJMP' - Logging does not show any attempts

Hi all,
We recently got a call from a user who said he got a Microsoft Authenticator authentication prompt for something called 'ROJMP'. He did not know what it was for so he declined the prompt and, to be safe, he changed his passwords.
He only uses his work related accounts for Authenticator and confirmed that it was Microsoft Authenticator that sent the prompt. I checked his sign-in attempts (interactive and non-interactive) but nothing is showing up in the timeframe in which the prompt happened.
What could have caused Microsoft Authenticator to send out an authentication prompt? Does someone know what ROJMP means (could it be a Microsoft internal thing)?