it could also be an externally available suitelet, look for any of those, or it's a SOAP integration, in which case look through the integration logs for activity