Overarching question - Is there a way to see the actions that a specific user has performed? For example, is there a way to see what records a user has exported?
Details - We recently had an employee succumb to a phishing attack. The employee provided a username and password that could be used to access Civi. While we think that we were able to catch the problem before anything suspicious happened, we would still like to see what this user (or someone pretending to be the user) did while in Civi. We are specifically concerned about any downloaded information. We are running Civi 5.24.5 and our website is using Drupal 7.