ah. Yea pretty sure our sandbox submitted a file to a vendor when it shouldn't have, but we refreshed since it happened. Not 100% sure yet, but it seems like the most likely explanation.