Where is the email account password change log?

Question

Where is the email account password change log?

Answer

The cPanel software doesn't have an explicit log file for password changes. However, you can use the grep command to find when an email account's password was changed using webmail:

grep -a passwd_pop /usr/local/cpanel/logs/access_log | grep 'email%40domain.tld'

Replace email, and domain.tld with the email address you're searching for. %40 is the URI encoded value of the @ symbol.

A password change would have a POST request to /execute/Email/passwd_pop

POST /cpsess7190411674/execute/Email/passwd_pop HTTP/1.1" 200