Question
Where is the email account password change log?
Answer
The cPanel software doesn't have an explicit log file for password changes. However, you can use the following grep command to find when an email account's password was changed.
grep -a passwd_pop /usr/local/cpanel/logs/access_log | grep $emailusername | $domainname
Please note that "$emailusername" and "$domainname" must be replaced with the username and domain name portions of the email address.