Domain accounts lock out

We are running a Win2k A.D. domain, with several servers in different physical locations. Every month or so, the domain accounts will become locked out on their own. Sometimes this affects the entire domain users, sometimes just 1 or 2 organizational unit members. Our campus Win2k expert swears this is an indication that we are being hacked, but we see no evidence of hacking. Is this an anomaly in Win2k server that anyone else has ever seen? Any ideas where this might be coming from? Thanks.