Under attack: security audit failures - event 529

Since 4/9/07, I have 119,132 security audit failures (event id 529) and counting in my security log on my domain controller (Win2k3 SP1).

In the past, there have been attacks of shorter duration which run scripts against my open ports testing something like 3 different usr/pwd combinations per second. All previous attacks lasted at most a couple of hours. Now this one is going on for days already.

I have ports 25, 80, 110 and 3389 open on my Watchguard Firebox X500. All ports forward to my DC.

I need to put a stop to this but I am clueless/helpless how to start. I don't think there has been a successful hack (yet), but I can't just sit there and watch this go on forever and ever.

A sample event would look like this:
Logon Failure:
       Reason:            Unknown user name or bad password
       User Name:            luis
       Domain:            my domain
       Logon Type:      8
       Logon Process:      IIS    
       Authentication Package:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
       Workstation Name:      SERVER
       Caller User Name:      SERVER$
       Caller Domain:      my domain
       Caller Logon ID:      (0x0,0x3E7)
       Caller Process ID:      812
       Transited Services:      -
       Source Network Address:      -
       Source Port:      -Start Free Trial