I recently had an issue where a customer's Exchange production environment servers both had their passwords changed, seemingly inexplicably. The security logs were predictably overwritten shortly after so I cannot state what actually made the change any more.
Given the fact that the rest of the computers in the domain did not also change passwords at the same time, I'm concluding that an administrator (or an application / service running elsewhere) made the change to the password to both machines within a few seconds of each other. The issue hasn't re-occurred in the last three weeks.
Has anyone seen anything similar in the past?