Who changed Administrator password?
This can be accomplished by auditing changes on the registry key corresponding to the Administrator account. See Q173939 Lost the administrator password? See Recover Lost NT Administrator Password for do-it-yourself, freeware, and commercial solutions.