Thanks. I'm not sure off the top of my head how I did the domain setup (its been a minute). I setup my own minecraft server for my kids and their friends just to have them somewhere that I had some control. I was able to figure out who did it eventually by a confession. I think all I did was create a subdomain in Cloudron when I installed it. I generally do this with any app.
It's a wake up call though that I need to review the setup and figure out how to have log rotation and retain logs for longer periods of time in case I need to do an investigation like this again.
Thanks for the help!