who have changed the password of a user in AD

The following command will show that when the password has been changed

C:/>net user username

Then from above command you will know that when that user password has been changed.
then go to event viewer and security logs on your DC and check the events that are accord at that time, you will see the event ID=4724,

please note that Auditing will be already enabled in your AD environment.