I've seen it, but I don't know why it happens. When a user is successfully logged in, the domain that Windows reports the user is using is sent back to the client. Some times windows translates the domain name, no idea why though.
You can set it for this user by right clicking them in EEM and doing "Set SSO..", but as to why sometimes Windows reports an odd domain name for them, no idea sorry.
Is this issue easily reproducible?