Any services or scheduled tasks that might be setup under this account?
Possibly, however the password hasn't changed in the last 30 days that it would cause this.
Then something was turned on recently that is using a password older than 30 days.
Nope. Turns out I had a couple servers that I was giving RDP remote access to another vendor for them to migrate to a new server and I forgot to turn off RDP.