How to track user password resets

I have an issue with an employee. This employee hacked into the admin account claiming that they had to rest their user password…. and that the password reset would not work. I don’t believe the story but my boss wants more proof.

What my boss is looking for is there any log that will show us that the employee in question did indeed change their password. If the employee did not change their password once in the admin account as described then there would absolutely be no reason for this breech.

Is there a log or file that I can view?

All the best,

Richard