Security on server 2000

Hello, I am a very new server admin.
I have a windows 2000 server. I looked at the event logs and saw that someone was trying tocrack the system. There were hundreds and hundreds of unsuccessful logon attempts during last night.
Each attempt used the name of a user account on my server. How did these names get found out?

Also, is there a way to monitor the incoming traffic so I can maybe see soem ip addresses of where these unsuccessful logons are coming from.

Thank you.