Audit of scheduled tasks

We have obtained multiple “password change” records.
Fortunately these attempts have failed.

The problem is that it has occurred on multiple devices in a short period of time.

According to the “username” field it looks like they were made by our admin, plus the “Orbini” request seems to indicate that it is due to a scheduled task.
Here I have 2 questions.

In 4.0 where can I see the scheduled tasks, done or waiting to be done and details?
Is it possible to get a log showing who and when created this task?

We want to rule out that this is due to an error and not even unauthorized access to our admin user.