Account Lockout Tools
http://technet.microsoft.com/en-us/library/cc738772%28WS.10%29.aspx

This will give you the following informaiton

# DC Name: Displays all domain controllers that are in the domain.
# Site: Displays the sites in which the domain controllers reside.
# UserState: Displays the status of the user and whether that user is locked out of their account.
# Bad Pwd Count: Displays the number of bad logon attempts on each domain controller. This value confirms the .domain controllers that were involved in the account lockout.
# Last Bad Pwd: Displays the time of the last logon attempt that used a bad password.
# Pwd Last Set: Displays the value of the last good password or when the computer was last unlocked.
# Lockout Time: Displays the time when the account was locked out.
# Orig Lock: Displays the domain controller that locked the account (the domain controller that made the originating write to the LockoutTime attribute for that user).

With this you might get hints as to what is doing this.