Reverse lookup
When a Windows machine is given a DHCP address from the Windows Server DHCP service, it registers the PTR record (IP-to-name) in the Windows Server DNS service. Unless you prune those, they stick around indefinitely. Then, when you ping an address, the pingER will do a reverse lookup of the pingEE's IP address and find the PTR record in DNS. You may even get different hostnames with every ping, if there are multiple PTR records assigned to one IP.