I would also look for spyware and keyboard loggers as well as the EVENT VIEWER for clues. You would also be at SP4.

Think you got all the Spyware? Try http://www.pestscan.com/Scan.asp

Bob