Oddly enough this does not happen for TV shows despite everything being on the same filesystem, I am using plex in unraid and everything is in the same docker “mount”
if it is emptying the trash (and not just deleting which would do the same thing in the end) there should be a line like [IPAdress:port (Subnet)] PUT /library/sections/5/emptyTrash (33 live) #2df43 TLS GZIP Signed-in Token (BigWheel)
That is what we need to determine by looking at the logs. the IP address would at least indicate where the request was coming from. It could have been done manually in web app or via some third party script for example on another device..