My account was created in 2013 and changed the password last in 2016. I went back and looked in the audit log for the last year and there was nothing else suspect. Just some failed logins, but that's pretty common, I didn't see any logged in usage from any IPs but mine