Does an SFTP login get accounted for with `last`? At first glance it doesn't show, but I also just learned about the existence of `last` as well.

I'd suggest that you look in one of the log files in /var/log (depending on your syslog configuration settings) as this information will be there if configured appropriately. last is basically only used when you run login. If you do not find it, then an appropriate reconfiguration of syslog and/or sshd_config might be in order.