How to tell when a managed service account password last changed

Look at the Active-Directory attributes of the MSA. Specifically pwdLastSet, which tells you when the password has been last changed.