If you are doing this type of forensics, then IMHO this justifies changing a system stored procedure for the duration of the investigation.
Look at the source of sp_removedbreplication and add code that will log the connection details of who uses it into a table.
Remember to revert back to the standard MS code when you have finished...
Original author: SQL Server FineBuild 1-click install and best practice configuration of SQL Server 2017 2016, 2014, 2012, 2008 R2, 2008 and 2005. 1 Dec 2016
: now over 39,000 downloads.
Disclaimer: All information provided is a personal opinion that may not match reality.
Quote: "When I give food to the poor they call me a saint. When I ask why they are poor they call me a communist." - Archbishop Hélder Câmara