Do you have a server, (or workstation I suppose), called EXCHANGE on the same network? Does it have a user called administrator?

Because that looks a lot like another computer trying to access this particular one rather than someone trying to access it.

I'm guessing that the computer showing these log entries is on the trusted network and so is the computer called EXCHANGE.