If this is possible for you and others, the contents of records can also be removed without using forms. If it wasn't you, it was a third party.
The best, because comprehensive, protection would be to add it at table level, @The_Doc_Man has already described this. In addition, you would then...