Simple User Clarification Message

Hi USERNAME,
We noticed that at `TIMESTAMP` UTC your user `USERID` was used to ACTION on `DEVICENAME`.
Was this you and if so, could you elaborate a bit on why you did this?

Relevant Note(s): Incident Response