Can't you get the HostName from a trace of who is running alter view statements on that view? Then possibly track down the actual physical computer doing it?

Or as an extremely dumb solution just schedule a job to run every however often that changes the view to whatever it's supposed to be then see who complains when their alter view statement gets rolled back right after they run it?