Critical error in security log

About once a week I get the following error in my security log:

Logon Failure:
  Reason: Unknown user name or bad password
  User Name: stephen
  Domain: ALWAYSONCS
  Logon Type: 8
  Logon Process: IIS
  Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
  Workstation Name: SERVER1
  Caller User Name: SERVER1$
  Caller Domain: ALWAYSONCS
  Caller Logon ID: (0x0,0x3E7)
  Caller Process ID: 1936
  Transited Services: -
  Source Network Address: -
  Source Port: -

The user name changes, usually not even a user on my network.  Is this a hacker trying to gain access to my network, or is it some bug in MS SBS that causes it?  If it is a hacker is there a way for me to trace where it is coming from?

Thanks.