Domain User lockout after SQL Cluster Failover
The problem with finding saved creds in SQL Server is that it's usually stored client side.  You will have to capture people trying to connect to the server, but it's interesting that it only occurs You could run a extended event or a trace and capture failed logins by that user, that will tell you if it's MS SQL Server that is locking him out.  Then you could view what time it occurred and capture other data.  

A lot of things could be trying to log in with his AD account.  Even a Excel reporting server elsewhere.  It's interesting the log in attempts stop because after you change the password, it works and it only happens after fail over.  

Are you sure it's in the SQL Server instance itself and maybe not something with the cluster group?  Perhaps it's something like a script on a failover disk or something related with the cluster.  I've had scripts do this before, or applications that store login creds.  Services are often a culprit as noted, and other potential configs.