Admin emails pointing to the dashboard

it only shows a post edit which was credited to the system user.

  1. I wonder why the system user would edit a post at all?
  2. why would the system user have login IPs listed?

to answer one question … it seems one user impersonated the system a few months more like years ago.