[Samba] 6713 auth requests from single user

[Tom Brown]

OS: Debian Woody
Samba: 3.0.4

I am seeing the following lines show up over 6713 times over the course of a 
day in the log:

[2006/10/05 16:05:55, 2, pid=7233, effective(65534, 65534), real(65534, 0)] 
auth/auth.c:check_ntlm_password(305)
check_ntlm_password: authentication for user [GEER] -> [GEER] -> [geer] 
succeeded

This user also cannot access the internet when the fileserver is down. This 
leads me to believe that the user is being authenticated through the 
fileserver everytime the user tries to access the internet. Any ideas on what 
would be causing this?

Thanks,
Tom