As I see what you mean. I dont think the nip-5 is stored in every note json. But changing your nip-5 results in another ‘profile metadata’ note posted so maybe you could derive when and if the account was compromised at some point.