Where is the email account password change log?
The cPanel software doesn't have an explicit log file for password changes. However, you can use the following
grep command to find when an email account's password was changed.
grep -a passwd_pop /usr/local/cpanel/logs/access_log | grep $emailusername | $domainname
Please note that "$emailusername" and "$domainname" must be replaced with the username and domain name portions of the email address.