Better use profiler to find out the login source. You may also check default trace files to check the program name from where its originating.