Unauthorised log ons

I am auditing my logons and object access. I keeps getting security logs that have statement like SYNCHRONIZE and Read Data for the my documents folder. My hdrive is not shared out. I ran netstat and another workstation was listed as an Active Connection. I went and got one of the On site IT staff to witness it. I notice in a few minutes my screen kind of blinked. I ran the netstat command again and the workstation was no longer listed as An ACTIVE connection. The workstation was in a room secured with no one around. The workstation is running W2k. and was on with the monitor turned off. The suspect works in another building. How did he do it?