An Electrum user operating a two-of-three multisignature Trezor setup submitted an incident report after noticing a substituted outgoing transaction in local history