We have an issue where folders from one library are appearing in another. No users claim to have copied / moved the folders there. Only a few folders from the other library appeared.
These folders do not have any files in them, but have some subfolders
What could be the cause of this and how can it be prevented?
Does the activity or history show who performs this operation?
I had one experience that a file was deleted in the web interface, but it automatically came back a few days later. It turned out to be the malware in my OS, so that the file cannot be properly deleted at a sync client side and be re-uploaded again and again.
So I would suggest disabling all sync clients and check if the problem persists. If not, then enable them one by one, and figure out which one causes the problem.