Yeah, someone has 'sa' privileges.
You might also look at the system_health extended event session. It captures some modifications along these lines (but not all).
"The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood"
- Theodore Roosevelt
Author of:
SQL Server Execution Plans
SQL Server Query Performance Tuning