>>Quick question - how did you check the Event Viewer?
>
>In Administration Tools, there is an item Event Viewer.
>
>Or, you can access it directly as %SystemRoot%\system32\eventvwr.msc /s.
>
>This would have been probably under Application or System page.

Yes, I found it already. What exactly should I check - Application, Security, etc.?

Did you ever figure the source of the problem?
==============================================================================
In the Application Viewer I see more than 80K records for MSSQLServer with the text similar to

Failure Audit Event ID 18456

Login failed for user 'sa'. [CLIENT: 72.158.7.242]

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
===========================================

How should I interpret that?

Thanks.