Well exactly not confirmed but You can perform auditing to determine who may be creating accounts.
There is a policy setting called “audit account management” that you can enable.The description of the setting is below.
Audit account management
Computer Configuration\Windows Settings\Security Settings\Local
Determines whether to audit each event of account management on a computer.
Examples of account managment events include:
a.. A user account or group is created, changed, or deleted
b.. A user account is renamed, disabled, or enabled
c.. A password is set or changed
By default, this value is set to No auditing in the Default Domain
Controller Group Policy object (GPO) and in the local policies of
workstations and servers.
If you define this policy setting, you can specify whether to audit
successes, audit failures, or not to audit the event type at all. Success
audits generate an audit entry when any account management event is
successful. Failure audits generate an audit entry when any account
management event fails. You can select No auditing by defining the policy
setting and unchecking Success and Failure.