The documentation for LockoutStatus defines the field like this:
Orig Lock: Displays the domain controller that locked the account (the domain controller that made the originating write to the LockoutTime
attribute for that user).
You can access the attribute properties from replication metadata.
$LockedAccount=Get-ADUser [username here - no quotes needed]
$LockedObjectPath=$LockedAccount.DistinguishedName
$DomainController=([system.directoryservices.activedirectory.domain]::GetCurrentDomain()).DomainControllers[0].Name
$LockoutReplicationRecord=Get-ADReplicationAttributeMetadata -object "$LockedObjectPath" -server $DomainController | where {$_.AttributeName -eq "lockoutTime"}
Write-Host "$($LockoutReplicationRecord.LastOriginatingChangeDirectoryServerIdentity)"
Parse that line for just the server name.
I'm doing this on a 2012 domain, but I think all this code works on 2008. So far, all the test cases I tried were locked out by the server with the FSMO role, so I'm not sure if this will give the output you expect. It looks like you have a great environment to give it a try. This code just takes the first domain controller in the list, and I imagine that you will be looping through them all to get the bad password count on each one. In that case, substitute whatever variable you are already using as long as it is the name of the server in text format (doesn't have to be FQDN like it is with this code)
I can't confirm that this is the same information that LockoutStatus.exe
uses, but it takes the same amount of time to run and for me, the output matched.