Try auditing create,drop and audit user stmt

AUDIT CREATE USER
AUDIT ALTER USER
AUDIT DROP USER