Before I conclude about anything, I just want to be sure it's from the previous incident and not recently.
Best way to know if account ownership didn't change (again) is to ask this member to sign a message from bitcoin address and prove ownership.
On second thought: only password resets via email show up, it appears email changes aren't logged.
This is correct.
I know members who changed their email addresses from within account profile and there was no warning about changed email address shown on their profile.