Sql-server – Discover who changed SQL Server service state

If the correct auditing is turned on, and the security event log hasn't rolled over it'll be in there. Failing that it may not be.

You could look at NTFS file permissions and ownership, and what accounts have sysadmin rights and possibly figure it out.

Typically they aren't run under a different account, but all under the same Windows account. This makes the management much simpler as there is only one account's password to change. The downside to this is that if the password needs to be changed for the account all the servers need to be restarted at once.

As for permissions, just set the SQL account as a normal domain user, and let the SQL installer modify the rights on the machine that are needed. It will give the account the rights that it needs to run SQL.

The benefit to having one account per service is that you get a more fine grained control of what objects on the domain each account gets rights to. While more secure in larger environments it often isn't practical to control things at this level as you'll quickly end up with hundreds or thousands of accounts just for running SQL Services.