Have you tried setting up a Profiler trace on this server for failed logins? This will give you the hostname and possibly the application name of the connection to.

Are you able to connect to SSMS as this login directly?