Where is the email account password change log?
The cPanel software doesn't have an explicit log file for password changes. However, you can use the grep command to find when an email account's password was changed using webmail:
grep -a passwd_pop /usr/local/cpanel/logs/access_log | grep 'email%40domain.tld'
Replace email, and domain.tld with the email address you're searching for. %40 is the URI encoded value of the @ symbol.
A password change would have a POST request to /execute/Email/passwd_pop
POST /cpsess7190411674/execute/Email/passwd_pop HTTP/1.1" 200