How can I see if the admin account has been used to make changes on an appliance?
You can do this if your Firebox is logging to a Dimension server. The report that you'll want to look for is the Audit Trail.
-Audit Trail Report
Summary of configuration changes for a device. Includes the user account that made the change, the change that was made, the date and time of the change, and a brief description of type of change.
To include this report in a schedule, select the Firebox Reports > Audit Trail report.
(About Dimension Reports)https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/dimension/reports_report-list_d.html
WatchGuard Customer Support