When and by who was a password changed
You can get the last time a password was changed by using dscl:

$ dscl . read /Users/&lt;username&gt; | grep passwordLastSetTime -A1


You will then get a result similar to the result below; the time will be in epoch (Unix) time.

&lt;key&gt;passwordLastSetTime&lt;/key&gt;
&lt;real&gt;1489446910.113889&lt;/real&gt;


Then, to convert epoch to something useful, you need to drop the mantissa (fractional part) since epoch is measured in nano seconds (useless for our purposes here)

$ date -r 1545267484
Wed Dec 19 19:58:04 EST 2018