Here's the ftp access log on the W2k machine:
#Software: Microsoft Internet Information Services 5.0
#Version: 1.0
#Date: 2007-02-06 19:12:54
#Fields: time c-ip cs-method cs-uri-stem sc-status
19:12:54 192.168.0.18 [2]USER anonymous 331
19:13:01 192.168.0.18 [2]PASS
emailaddress@site.com 230
19:13:08 192.168.0.18 [2]created ipconfig.txt 550
19:13:52 192.168.0.18 [2]created mdum09.txt 550
19:29:48 192.168.0.18 [2]closed - 421
19:47:21 192.168.0.18 [3]USER anonymous 331
19:47:27 192.168.0.18 [3]PASS
emailaddress@site.com 230
19:47:33 192.168.0.18 [3]created ipconfig.txt 550
20:02:50 192.168.0.18 [3]closed - 421
20:18:41 192.168.0.18 [4]USER Administrator 331
20:18:46 192.168.0.18 [4]PASS - 230
20:18:59 192.168.0.18 [4]created ipconfig.txt 550