There should be log files for actions in the Adobe Admin Console, with a possibility to see:
when someone did a change in Admin Console (adding users, removing them, adding permission groups, changing permissions, etc.)
who did it (also including automated changes, e.g. via user authorization tools)
Also, it should be possible for System Admins to subscribe to the logfiles or set up certain alert rules to be immediately informed about critical changes (e.g. another Admin being removed, new external users, alarming amount of users added/deleted...).