Is it possible find out who changed sitecore password through sitecore logs or db ?
Not after-the-fact. I just tried logging into a vanilla Sitecore 8.2u2 instance as admin and changed the password. The only AUDIT message in the logs (where you would normally expect these events to be registered) was this one.
14264 15:41:03 INFO AUDIT (sitecore\admin): Login
It is possible that if you installed something like the Advanced System Reporter, you would be able to get more detailed information on what your users were up to. But this would not apply retroactively on what has already transpired.
I would take the issue to Sitecore Support; I feel a change password event is worthy of an AUDIT log entry out of the box.