All access should be recorded with IP, date and time.
It should be great if a notification could be send on new IP.
If someone has a successful login with a new device you already get an e-mail.
You can also enable REQUIRE_DEVICE_EMAIL so a login will fail if an e-mail could not be sent.
Also, all login attempts have IP’s in the logs.
Sorry 
Thanks a lot for this answer. I’ll try it.