If you are doing this type of forensics, then IMHO this justifies changing a system stored procedure for the duration of the investigation.
Look at the source of sp_removedbreplication and add code that will log the connection details of who uses it into a table.
Remember to revert back to the standard MS code when you have finished...
Original author: https://github.com/SQL-FineBuild/Common/wiki/ 1-click install and best practice configuration of SQL Server 2019, 2017 2016, 2014, 2012, 2008 R2, 2008 and 2005.
When I give food to the poor they call me a saint. When I ask why they are poor they call me a communist - Archbishop Hélder Câmara