User is saying their account is hacked

As an admin you can look at their stats at admin/users and click on the user. You can see the IP address they signed up with as well as the last IP used to log in with.

If you go to the user’s preferences page /u/username/preferences/account, that will show what Recently Used Devices (browser(s) and IP address(es)) were recently used to log in.

I have one user that apparently has been traveling around California and it shows two different cities in 2 days (2 log ins). Just something to check out to verify your user’s claims.