If all previous ideas do not work, try running NetMon or any other
"sniffer" on the Domain master browser. It will receive a browser
announce frame sooner or later. The frame will tell you which browser
supplied the name. Doing strings searches in a large trace could be an
issue. Some sniff...

[ more ]