Is there any pattern? For example all tickets that come in via email do this or from self-service? Email policies can also set a default technician so that would be a place I would check. There could also be a field default set for that field. Open a Work Order, put your cursor in the Technician field and press Ctrl-F2 on your keyboard. Here you can check to see if there is a default value. If I think of more spots, I will post them.