Create a trace (or look in the default trace) for security events. I can't remember offhand which event it is, Books Online will have details.
p.s. Why are you using the sa login? That login should be disabled.
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability