I run an LND node and recently had my phone stolen. I reset keys, and restarted all the channels and generally tried to reset everything ,but there's a lot.

I have 20+ peers and there's some forwarding and traffic, so it all looks good. But there's some transactions on rtl/lnd/transactions/payments page that I didn't make.

Are these forwards that my node is doing through the network and normal, or does someone have access to my node?

$ lncli fwdinghistory

only lists 4 forwards, but theres 10+ transactions in the same time period