How to catch a shifty consultant

I thought that would get some attention.

I need to tighten up Windchill security because there appears to be an issue with administrator passwords being changed.  I believe I know who is doing it, but don’t know why they would, and I can’t yet prove it.  I would like to document who is doing it.  If that is not possible, I would like to eliminate any chance that it is being done through a “back door” and lock down that access.  Can I simply change the password for the “other system”, or would that cause issues in other places?  We are not using Active Directory.  If I shouldn’t change that password, what other ways are there to improve security and verify how this is happening?  Thanks!