Does Linux record who last changed a file (rather than created it)? If so, how do I find this out? If not, is there some way of monitoring file(s)?
audit package using the package manager for your distribution and start the service.
Set a watch for a file you're interested in, such as
# auditctl -w /etc/passwd -p war -k password-file
audit records for that file
# ausearch -f /etc/passwd | less
Generally, no. I've never tried it, but if you want to track users accessing particular file, you can take a look at audit