2. Review CCTV of their movements for the 14 days prior.
3. Find the commonality.
If there's genuine interest in where it came from, I think the answer is certainly findable.