It came from the account email address, not any particular user at 10PM, when no one employed at this company was logged on. I did just supply the portal log in information for this particular customer at 6:30PM last night, which is why I thought it was caused in the portal + the timing. I can't export the Audit Trail, I keep getting an error so I can't audit against that.
ERROR:An error has occurred. An email has been sent to Method staff. If this problem persists, please contact the Method Team at method@methodintegration.com.