We had an issue like this, looked in Event Viewer, Security, and saw tons of failed logins all coming from one computer. It had some kind of malware that was attempting logins to the domain, and after x number of failed attempts, the respective account gets locked out. We disconnected that pc...