Neg,
at first I could not figure out why you were asking this, but I now I think I understand what you are asking.

Guess this has already been said, and I am no IIS guy, but:

Yea, brut force attack.
Were you able to find anything in any other logs around the same time to find the IP of the attacking machine?
Any chance of IDS logs available?
( also, was it attacking a FTP server ? )

I think the question was why both events?

The 680 event was because of the non-existent Administrator account, the 529 event was saying the attempt had a bad user name or password.

Again, I am no IIS guy, but I would think that once the attempt hit the first event it should have been stopped before hitting the second?

Or is that just me?