you should also look through your machine's Security Event Log during the time said user was there.

It *should* give you computer name, ip address (if via ip) and any user name it attempted (guest...