grep -a passwd_pop /usr/local/cpanel/logs/access_log | grep 'email%40domain.tld'
Replace email, and domain.tld with the email address you’re searching for. %40 is the URI encoded value of the @ symbol.
A password change would have a POST request to /execute/Email/passwd_pop
POST /cpsess7190411674/execute/Email/passwd_pop HTTP/1.1″ 200
https://support.cpanel.net/hc/en-us/articles/4413844628503-Where-is-the-email-account-password-change-log