Are you recording login success/login failure in the engine? If so you can look in the ERRORLOG to see what did it. If you don't do this you should at...
You'd need to get a developer to write an SQLCLR function which can implement the SMO assemblies (which have a T-SQL parser class, apparently, though I never got it...