Set up a SBS2011 server 7 months ago with only 2 users: Administrator & Duncan. All was well until today when Duncan tries to log in but gets "Username or password incorrect" message; Tries to log in as Administrator & gets message "Your account has been disabled". No-one else has access to server so no-one could have been meddling. Tried re-booting in both normal & safe mode with same results.
Do you have a machine joined to that domain? Can you login to the domain as Duncan on that machine? Is Duncan in the Admin group?
You can check this article, has instructions on resetting a password.