This is suspicious:

  *The "new security policies" were introduced two weeks  
   before our audit, and the six months historical logging
   was not required before the policy changes.

These "policies" were introduced by whom? His payment processor or by his company on the advice of this "auditor"? Or did the OP make this up?

  In short, I need;

    A way to 'fake' six months worth of password changes 
    and make it look valid
    
    A way to 'fake' six months of inbound file transfers

Why is the poster requesting help generating plausible fake data? Is he naive? Afraid of losing his job? Unaware of the legal implications?