Re: Service Account
Look in your DC security logs for login entries. Interactive logins where someone is pounding keys is a different type of login than a service activating (I think interactive is type 3, network activity is 7, can’t recall for sure).
Have a look thru :google: for login types, then filter your DC security logs, since that’s where the login type is recorded (assuming you have the necessary logging turned on, as tehcamel pointed out). Once you know date/time of interactive logins, you can start looking more deeply for other clues as to who the culprit is.