I think that's most likely it. It has to be checked out though. Somebody in the supply chain is doing some shenanigans on the side and can't be trusted.
Should gather approximate addresses and "triangulate" where culprit(s) might be, if that's possible.