You really didn't answer whether you've ever applied the "patch" I linked to above. And Mark tried to steer you in the right direction by having you look in the "event viewer". The event viewer marks events such as time synchronization.
There are a few ways to access the event viewer (typical for Windows), but probably the easiest is to just click Start. Click Run. Enter in the "open" box:
The event viewer app will pop up on the screen. On the left side of the viewer, you'll see headers such as "Application", "Security", "System", etc. Click on the "System" header. Make the app full screen if you can't see all the columns.
Look at this picture to see what the "System" section of the event viewer looks like. Note that the red and yellow icons you see in this picture apply to this person's pc, so your system information will be different:
But notice in the picture the "Source" field. In the picture, you'll see one of the sources being "W32time". That's the Windows Time Sync service. Notice that this person's W32Time entry has a Yellow icon next to it. Yellow signifies a warning that something may not have executed correctly. (Red signifies errors). Your W32Time entries may or may not have yellow/red icons. What I'm most interested in is what they DO say when you doubleclick on them to open them up.
So, look down the source field and go back over the previous night's entries (assuming that you had the time set correctly BEFORE you went to bed). Find any W32time entries that show up during that period where the time may have been changed.
Doubleclick on each one and see what they say. Report back here. Report as to whether any of them have yellow or red icons, too. But definitely doubleclick on the W32Time entries so you get a popup box that explains what happened during that "source" and report back here. Try to type out EXACTLY what it says in the "Description" box. Leave out the bottom part of the description where it says "For more information, see Help and Support...". You don't need to report back with that part. That's standard verbiage. Just type out the text above that part.
One last note: If the Start/Run command for opening the event viewer doesn't work, open up Control Panel, then "Administrative Tools", then "Event Viewer".