There are events in the Security Events that are catagorized by "Directory Service Access". These appear to happen when logging in and out. However, there were none of these events on the affected user's first and second logins this morning. Not until the third did these events occur.