The user.start event is when the agent starts handling the conversation and the user.end is when the agent releases the conversation. They appears to be in the right order to me, although the agent sure didn't spend much time handling that email.

When an email is being sent with multiple actions on, the event bridge sents the following events (and timestamp of the event):
user.start (2024-10-21T13:20:56.727Z)
user.end (2024-10-21T13:20:56.902Z)

I would assume that the order should be in the opposite because the conversation (and user) is still connected the the conversation.

Why is the user.start the first event and not the last?