I've not read through the entire thread so apologies if this has already been suggested or if you know this isn't the case, but are you sure this is machine related. I had a similar problem once where issues manifested themselves on a particular machine. It turned out that the PC seemed to corrupt the profile of everyone who logged on, and the problem then transferred itself to another machine by corrupt profiles. It acted like a virus but we never found any virus activity.
Does the same teacher have the same problem if they log on somewhere else? Do all users on this laptop have the same problem? I assume you're using roaming profiles? If you make sure all profiles are deleted and delete the users profile from the server, do they still have the same issue?
Probably unlikely as I think you said this is a new build, but it's worth a shot!!