Is it? I'd expect a write-only logging system that runs at a low level exporting logging to remote servers that other admins don't have access to. As the article suggests, you layer admins so no single person can truly compromise things.
It should be pretty basic to catch someone that's resetting user's passwords.
It should be pretty basic to catch someone that's resetting user's passwords.