Otherwise your company might be liable. The access was done by someone who broke into your machine. Again, you could be liable for actions taken by criminals using your facilities if you don't try to stop them. As the notified sysadmin, you should take action to investigate it. Normally you should be aware of what contacts people have from your small company.
Legitimate accesses are no problem.
A simple question suffices to clear it up. Someone may have gotten a list of user names with passwords and was trying out the only one on there of the site that noticed it. Some cracker may have 20 passwords to the site and try one from each of 20 sites he has already broken into. It isn't fun to find out you've got a cracker on your system. Cracker tools are so common that my presumption is that if one account is compromised, all accounts and all programs are compromised.