1. A non-transitory computer-readable medium of a content management system for storing files, each file being associated with one of a plurality of namespaces and one or more user accounts, the non-transitory computer-readable medium comprising: computer executable instructions stored on the computer-readable medium, the computer executable instructions, when executed by a computing device cause a computer to: maintain a log of file events, the log including a plurality of file identifiers each respectively associated with a namespace, a file event, and a user account responsible for the file event; analyze the log of file events to identify a total number of compound events associated with a first namespace of the plurality of namespaces and associated with a first user account of the one or more user accounts; analyze the log of file events to identify a total number of deletion events, excluding the total number of compound events, associated with the first namespace of the plurality of namespaces and associated with the first user account of the one or more user accounts; and send a notification to the first user when the total number of deletion events, excluding the total number of compound events, is greater than a threshold, the notification identifying the deletion events not associated with the compound events.