How can I tell who changed the password?

You could log all attempts to get the lost password email:

add_action( 'retrieve_password', 'log_password_requests' );

function log_password_requests( $user_name_or_email )
{
    // save the user name or email plus the IP address in an option
}