The Suitelet is not available without login, and executes as the current role. It generates an estimate from a sales order record. The user in question was adamant they never clicked the button that calls the Suitelet. The role of the user was the odd part as they wouldn't traditionally create estimates even though they had permission to do so. Was probably just an accidental click, and I've excluded the button for the role to prevent it. I couldn't see NetSuite falsely reporting the user who generated an estimate but thought I'd check. Thanks @creece and @Sandii