Thanks for the tip, it put me on the right track :). This is definitely what happened: someone did eject the nic from Windows:
Any user can eject devices, even non-admin ones (come on, Microsoft, it's a server OS!!). It's an RDP host and I bet their GPO don't restrict user access to that...