Tracking down a user in a large AD network

All,
First, forgive the x-post.  I'm not sure, based on list volume, that 
anyone else is subscribed to the IH list =). I have quite the dilemma
on my hands.  I work on a pretty large AD domain with nearly 100 
domain controllers.  We recently had an OU with about 5000 users 
deleted from the directory.  I know the name of the user, but....
it is a shared account.  (I know, but with over 100,000 users, these
things slip by)

What I need to do is track back to the workstation that was used for
the login, and I haven't had much luck.  I'm focusing on event 673,
but I'm not sure this is the right angle.  Any ideas??

TIA,
-Ds