Erroneous email stating son's AppleID was used to sign into iCloud
My son's iPad is signed into iCloud and he's part of our family group.
A couple of times recently we've got an email from Apple (genuine, not phishing) stating that:
[son's name]'s Apple ID was used to sign in to iCloud on a new device.
However, when I sign into his AppleID and check, no new devices have been added - only the two we know about (his own iPad and the family AppleTV). He's also got 2-factor authentication turned on so I presume no-one could be using the AppleID without our knowledge.
Why are we getting these erroneous messages? What is triggering them?
Thanks.
iPad (5th gen) Wi-Fi