Search:

It may be possible, with a cracking tool, to ferret out the domain admin passwords. My own policies cleared those from systems on logout, in my previous life. But, I also didn't use those for logins....

JewishIntent made a good point. There is also the possibility that the person installed a keylogger on one of your systems and has been grabbing the information that way. That is a lot of work and...

Depending on the OS you are running, you will also need libpcap or Winpcap. For Linux you should check out:

http://www.tcpdump.org/

For Windows:

http://www.winpcap.org/

You'll need these...