Maybe I’m missing something, but I’m not seeing anything in the NATO SOFA that would authorize a “sending State” to conduct such an operation in the territory of a “receiving State,” even in coordination with the receiving State’s authorities.
What exactly is the ‘operation’ you are referencing?
What I am suggesting could happen is not a matter of how the operation is performed, but who performs it, or who is involved in performing it. The ‘event’ is completely lacking in detail, and it is within the realm of possibility that some US military could be involved in the transfer of evidence or materials.
Where the SOFA is involved, things don’t always work the way you’d think.
As for whether it actually happened, I’m dubious that a massive fraud with the folks involved could get electronic fraud and physical ballot counts to match. It would necessarily have to be limited in scope (albeit not size) or it would be easily demonstrated where they botched it up.