A user tried to log on today and discovered that his password had mysteriously been changed. All I can assume is that he left his computer unattended and someone changed it.
Is there any way to tell when this happened, so as to narrow down who might have done it? I suspect the answer is "no" - I don't see a watchdog entry, and in
/var/log/mysql all there is is an error log, not a log of queries.
Is there another place where DB queries might be logged or is there somewhere else in Drupal I could check?