I've found that idle RDP sessions with an old password often cause problems like this. You can use the link posted by schepp and check out EventComb. Here's an article on how to use it for Account Lockouts.
http://support.microsoft.com/kb/824209
The results will give you a list of where the lockouts are occurring, from what server/ip, etc.
Good luck!