It's really easy to impersonate any user using domain wide delegation, and subsequent accesses aren't logged.
https://developers.google.com/admin-sdk/directory/v1/guides/...
https://developers.google.com/admin-sdk/directory/v1/guides/...
As far as I can tell, adding a delegate or forward isn't even logged anywhere, and being able to see what a delegate is doing was added as a feature only a few months ago: https://workspaceupdates.googleblog.com/2022/03/gmail-delega...