How to know "intruder" create email filter

Dear All, Can anyone help me find out which domain the email filter has been added to. because there was an incident where an intruder added an email filter on several accounts in a certain domain in my Cpanel account. Thank You