Have you checked the Licence Lease History in the QMC, under:
- QlikView Server
- Client Access Licences (CAL's)
This often can give clues, especially if a single User is trying lease a licence on more than 2 Machine ID's in less than 24 hours.
[Or are they using Virtual Desktops, or is the QV Desktop a Citrix App ?]
Best Regards, Bill Markham