It sounds like they're trying to connect to a database that doesn't exist, then. Are you auditing failed logins? If so check what it says in the SQL log. (Sorry if you've done that already!)