Hacker seems to know FTP usernames

From: Struggling sys admin (logica111_at_hotmail.com)
Date: 02/26/04 

Date: Thu, 26 Feb 2004 07:56:21 -0800

We have an old NT4 server with a few hosted sites on. Im
seeing in the security logs that someone is trying to log
in (and failing so far) with existing FTP usernames. They
havent figured the passwords yet so authentication fails.
So somewhere, someone is able to get a list of ftp
usernames on that box and im guessing it wont be long
before we start seeing sites changed. How is that
happening??