Anyway to find out what program is asking for admin credentials?
I would configure syslog to record those details into a file.

Assuming that you are comfortable with editing text files from the command prompt, use your favorite editor and edit /etc/syslog.conf adding this line:

auth.info;authpriv.*;remoteauth.crit   /var/log/authinfo.log


Then send a hangup signal to syslogd via

pkill -HUP -i -l syslogd


F.