A user signs in from a new country, registers a new MFA method, and exports thousands of customer records within minutes. Which conclusion is best supported initially?

1. The successful MFA event proves the activity is authorized
2. The correlated identity and data-access sequence warrants account-compromise triage
3. The export is harmless because the account has permission
4. Only the country change matters and the export should be ignored