How an entry got on a block list?

We just determined that an entry on an enterprise block list was affecting legitimate email to a senior executive. 

I've deleted the entry to allow the mail flow ASAP, but is there any way to identify (I suspect before an entry is removed) how an enter was created?  IE, via a manual administrator action, vs a smart header action?

Searching did not lead me to an answer.


Added TAGs
[edited by: Gladys at 3:24 AM (GMT -7) on 1 May 2023]