These program(s) help you audit user logon activity to locate unusual activity:
Available as part of the Security Guide Scripts Download, this is a multi-threaded tool that will parse event logs from many servers at the same time.
Instructions on how to use EventCombMT are available over here.
Update (08th Aug 2007): Fixed the link to download the software and added the link to the instructions page