As AmeriCommerce rolled out multi factor authentication for storefront users we also built new tools to help admins see the full picture of their users. Not only will this help show when a user account may be compromised but can also be used as a reference to understand where the problem may be when a user isn't able to login.
To see a user's history navigate to Security > Users > Edit User > Login Devices/IPs
Here's an example of Login Devices and Login IP History:
For a comprehensive guide on how to handle a compromised account, view our help article.