Privileged activity outside business hours

An administrator logged in from home at 03:19 and restarted a database service on a production server, the live system the business depends on. A rule flagged it because it is outside working hours.

Your task: Decide if this was a person doing their job, or someone who should not be there. Look for a ticket, a page or an incident that explains it.