I would suggest searching the message tracking log to first have a check of the mail flow process of the email sent on November 14.
Then combined with IIS log (search with the message timestamp in message tracking log, while note that in IIS the timestamp uses UTC), we can determine from which device the message was sent.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.