MFA bypass impossible travel

An IdP (Okta) alert fires: a senior engineer's account authenticated successfully from their usual office IP at 14:02, then again at 14:11 from a residential IP in another country, impossible travel. Both sessions are active. The second session immediately accessed the admin console and created a new API token with broad scopes. The engineer says they're at their desk and did NOT log in from abroad. MFA shows as 'satisfied' for the second login. How do you triage, contain, and figure out how MFA was bypassed?