There are a couple of functions that will show you what your users have been doing with their accounts:
Auditing will The auditing functions will tell you about accounts' history - i.e. what has been done to the account(s) such as when the password was changed, when it failed to work because the password was entered incorrectly or even when the account was deleted.
You can view this over the organisation, or on the activity tab of any account.
PLACEHOLDER - SCREENSHOTS