If its not the XP logon promt he must have a BIOS password
There are a number of third-party security packages which require authentication prior to the Windows XP logon screen. Most I've seen (I can't think of any names off-hand right now... kinda preoccupied with what's going on around here) were originally written for Windows 2000 but work on Windows XP too. When you log on through them, some authenticate with Windows, immediately openning up Windows while others prompt you to enter the Windows password as soon as you've logged into the other program. Additionally, it may also be that he enabled the auto-logon with Windows XP but then ran a third-party program to protect the computer (one of the guys I know does that on his laptop because he thinks it's more secure than the Windows logon). Just thought you'd want some other options if, in fact, it's not a BIOS password (since, no offense intended to the guy who asked the question... if you can't tell if it's a BIOS password or not, you probably won't be able to hack it)

AJ