Can you investigate a compromised cloud account

Yes. Available login records, audit logs, email information, security events, IP addresses, forwarding rules, file activity and other evidence can be analysed to help determine when the account was compromised and what occurred afterwards.