Filtering by USER_EMAIL refers to the email of the person who changed the password (which can be the admin), not necessary the user whose password was changed.
To query for the actual user, the easiest is to set fields
to items/events/parameters/value
and then compare the results against the desired user email.
Sample:
https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_PASSWORD&fields=items%2Fevents%2Fparameters%2Fvalue
ADDITION
Should you want to query for USER_EMAIL
- please note that the correct query would be
USER_EMAIL==xyz@compamy.com.au
which in URL encoding would translate to:
https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_PASSWORD&filters=USER_EMAIL%3D%3Dxyz%40compamy.com.au