I think we need to make it more obvious when account-access occurs for users. If they can see their request logs they can investigate themselves, maybe even id

I think we need to make it more obvious when account-access occurs for users. If they can see their request logs they can investigate themselves, maybe even identify the cause or instigator. I think letting users define restrictions on their accounts would help too, like a firewall for which countries or cities etc can access their account, schedules for when signing in can occur or when it is disabled etc. Most people could just select their city and waking hours.