When is the last time you checked who had administrative rights on your domain? This is something I get called in to review, someone was added to the Domain Admins account who should not have and caused issues. My recommendation is to review this group once a month to ensure that people are not in that group who should not be.