My question is: How exactly does it determine which computer has recently logged in? Is it reading an attribute from AD such as lastLogon?
Yes, it reads this from all domain controllers because the date is not replicated.
Also, does it scan only the specified OU or also any sub OUs?
E.g, if I have the OUs
domain\MyComputers
domain\MyComputers\Loc1
domain\MyComputers\Loc2
and I tell it to scan domain\MyComputers, will it include objects from the Loc1 and Loc2 OUs?
Both loc1 and loc2 will be scanned if you can domain\mycomputers.
Note that you need to enter the ou in adsi format: ou=mycomputers,dc=domain,dc=local