I'm doing something similar. I'm checking sysprocesses every 5 minutes to look for users with certain patterns.

I ended up here because I have been seeing one user whose sessions sometimes show up without a value in loginame! I used Profiler to watch logins and logouts and I see the session, and there is a value for the login name. When run from SSMS the query has never shown this blank loginame, but I do track it when the query is run from Server Agent.

Does anyone have any idea how a session could legitimately show up in sysprocesses without a loginame? And if I don't see it in that column can I get it from somewhere else? (the case I know about is an SQL user)