table sys.user$ contains the field ptime, which keeps the time when the
password was changed the last time over. Do not confound it with ctime, which
is the "creation time", nor with ltime, which is the time the account
has been locked (if any).
SELECT NAME, ptime AS "LAST TIME CHANGED", ctime
"CREATION TIME", ltime "LOCKED"