Download the account lcokout tools from Microsoft;
http://www.microsoft.com/downloads/details.aspx?familyid=7af2e69c-91f3-4e63-8629-b999adde0b9e&displaylang=enThere's a tool called eventcombMT.exe this comes with a built-in search for account lockouts that will tell you where the bad attempts are coming from. This should be a good starting point...
