EventCode 626 means "account enabled". If you are looking for account changes, then you should do that in a separate search.
EventCode=626 |table Caller_User_Name, Target_Account_Name
The caller is the person who changed the account, and the target is the account that was changed.
... View more