That week in July, Trump drew criticism for his decision to let his daughter Ivanka fill his seat at the G20 meeting of top economic powers in Hamburg, Germany. After days of the pile on, Trump took to Twitter the morning of July 10 to claim his decision to have Ivanka represent the U.S. at the G20 was “very standard” and that Chancellor Angela Merkel of Germany agreed. Not more than 15 minutes later, he switched his tenor and began attacking Clinton and the press. “If Chelsea Clinton were asked to hold the seat for her mother, as her mother gave our country away, the Fake News would say CHELSEA FOR PRES!,” Trump said.

Clinton shot back: “It would never have occurred to my mother or my father to ask me. Were you giving our country away? Hoping not.”

That tweet garnered more than half a million likes, including by the account for the U.S. mission to the European Union. That kickstarted a weeks-long investigation, prompted by the secretary’s office, into who exactly at the Brussels mission had access to the Twitter account and hit “Like” on Clinton’s tweet, according to two former U.S. officials. (Full disclosure: Clinton sits on the board of IAC, The Daily Beast’s parent company.) Nearly 10 people were interviewed about whether they, as administrators of the account, had mistakenly or deliberately pressed the “Like” button. All of them denied any wrongdoing, those sources said. One individual familiar with the exchanges said the Secretary of State’s top managers in Washington “wanted blood” and called Brussels numerous times demanding the name of the culprit.