Super User removed

I'm running some tests on my end — with "Forbid new admin accounts" set to No, the Firewall shouldn't have triggered anything on its own, so I want to rule out a couple of other things before going further.

A couple of questions:
1. Were Justin's and Sara's accounts in the Super Users, Administrator, or Manager group (or any custom group with backend access)?
2. Do you recall any changes to user group permissions, a database/site restore, or any other Firewall settings being toggled around that date?

Thanks,
Jose