security logs on the DC? If you forward your login attempts (failed and successful) to a log aggregator, then you can look in a single place for the failed logins associated with the user name and find a source/dest.

The other thing would be the network logs. traffic to/from that DC, packet captures. that will also help you find the source.

suddenly the stale sessions on a server somewhere, with an internet browser open trying to authenticate to the proxy with the user's old credentials become very apparent.

But, finding the application or service responsible for the stale credentials? I don't think that microsoft has a solution for that. There are some security solutions that will show you what processes called which processes and so on until you see which ones are calling networking processes and/or requisitioning networking resources and use that to narrow it down. but by the time it hits the DC it isn't providing info about what application is wanting the authentication, only "hey, do these creds check out? yes or no?" You'd need the session info from the source machine to be able to see what application initiated the session - and since session # info is not commonly saved, and is frequently re-used, you're looking at a root level security tool that saves all that info by default. Something with a network shim that documents all the network activity, and an internal ability to track what processes are calling what processes and link it to that network activity.

AFAIK there are only 2 major players on the market with that kind of tool (that is authorized and warrantied and isn't just a black-market trojan) - with others coming soon, I'm sure.