What's the best way to track down another script from a third party that seems to be setting fields on a sales order after they have been changed?

Depends what you mean by track down. Typically would just turn things off one by one until it stop happening

Yah, that's hard to do in production.

check the scripted records page view for the applicable record type, identify all active scripts + workflows performing actions in the relevant context + trigger (before load, before submit, after submit)

There was a bundle that catalogued all your customisations incl. being able to search scripts (that weren't locked) for references to fields It wasn't free though

Salto and strongpoint both have free tiers available

thanks