Is there any way to tell when a user's password was changed?
It is not possible to tell from the database it-self when user changed his password.

The user password in Drupal 7 is stored in users table with the following columns of interest:


pass - User's password (hashed).
access - Timestamp for previous time user accessed the site.
login - Column which tells you timestamp for user's last login.


However there are few workarounds:


If you've got logging enabled (dblog or syslog), Drupal logs when particular user has logged in. This should point you to the IP address (whether it's different as usual).
On live environments, periodical backups of database should be a must. Depending how often you do the backups, compare different dumps focusing on particular user and his password, for example:

gzcat db-dump-2017*.sql.gz | grep -w users | grep -w pass | grep specific_user


Note: Above command attempts to stream compressed dump of database in order to find value of pass column from users table for the given user.

Then check which database dump has the new changed password. From there you can check the logs (e.g. from watchdog table) for this user. Especially check IP addresses, requested URLs and authorization attempts (whether successful or failures).