Thanks all for taking the time to reply.

spaghettidba spot on. I'd been using the profiler to trace errors (which yielded nothing) but hadn't realised there was a separate failed login category which gave me a pid. From there I could see that it was a SQL agent call - a job that no longer had a database, but had previously been calling a proc in the now detached db X.

Now I can go to the app guys and see how they want to proceed armed with the right info.

Much obliged!