Just a thought, but a friend of mine had a computer with a failing power-supply that kept blinking out and in pretty regularly, it could be possible that the shut downs are hardware related. In your first post you said that it would shut down whenever you connected to the internet.. Which doesn't make much sence for a hacker to do, but (i'm not really sure of this) possibly it could be caused by the drain the modem causes on the P.S.
As for the extra user account.. Is it anyway possible that someone created an account and started some stuff up, didn't shut it down and then did a switch user leaving the operations open. I'm not sure if XP will restore other users operations after it gets shut down or not though.
Just my 2 cents...