Unauthorized changes to the password or group files can potentially be made by
security breaching programs. Monitoring changes to the password file
can show if this is occuring.