And what did the folks at the Apple Store in (presumably) Temecula California tell you about the state of this iPhone?
What was the value of the reported fraud?
What evidence of compromise do you have? That’s a very different question from sifting through logs, too.
What remediation steps have you implemented? What was the result?
If there was a password reset, were the other associated details and mail server credentials also reset?
Who has physical access to your iPhone?
Is two-factor authentication enabled here?
What was the result of wiping and re-loading your iPhone with known-good software?
And again, there are other and quite possibly uncomfortable and sensitive questions around finances, and access to sensitive or classified information, and relationships pending here in most any detailed investigations, too. You;re going ot need to engage directly.