On a tip from Skylar, I checked out office1's connection in the D224 closet, and determined that it's a flaky problem somewhere in there. Maybe a flaky connection on the Summit 48 (port 10), on the patch wall, or on the cable itself. I haven't really tested it out enough. But I wiggled the cable around and office1's connection is back up.
I've moved our proxy services from millie to admin. This frees up the last service that millie is used for, so millie is in cluster's camp now. I also added Privoxy to the equation to do ad filtering.
I've enabled netgroups for FreeBSD, with a STAFF netgroup containing basically the users in the wheel group. I also implemented an alternative for machines with pam_access installed. This involves using access.conf to limit logins to wheel group members.
Kevan and I replaced the Summit 48 with the faulty port with a brand spanking new Summit 48. Downtime was less than 15 minutes. All is working now.