convoluted solutions:

1. Run a sniffer that captures traffic only send to your printer IP address. This will require some authorization from the security department. Wireshark is free and available for Windows.
2. Tell the department the printer has been changed, and change the name and IP address from the printer. Put a server on that IP address instead. Let it listen for any incoming traffic and record sender and timedate (can be acomplished by a small perlscript)
3. Send somebody to the printer to configure BANNER_HEADER=TRUE and add more data to it. This would include sender hostname and username. See HP documentation.

Meanwhile, keep paper tray almost empty, just enough for normal usage, until the "error" comes, cancel job, and refill papertray... not pretty but it works. Good luck with the hunt.