New sign-in alerts on child's iPhone - what could be prompting them?

My daughter has an iPhone SE, with 2-factor authentication turned on. I'm her backup contact and my iPhone is her trusted device, which is why I also get sign-in alerts. Recently, she (and I) have been getting new email alerts at the rate of one every few days to say her Apple ID was used to sign in to iCloud on a new device, but it's not something she has done. There have been no 2-step verification alerts, and when we've checked on the device list in her iCloud settings even seconds after an alert comes through the only device listed that she is signed into is her iPhone SE.

I'm reasonably confident this isn't a password issue or hack attempt because of the lack of 2FA verification being triggered, the fact there aren't any other devices listed, the fact it says 'signed in' rather than attempted (i.e. it was successful) and the alert emails never give a location. This makes me think an app or service is signing in. Does anyone have any idea what it could be and why it's prompting iCloud notifications? As I say I don't think it's a problem, but it would be nice to know!