Weird info in POA logs

GW 7.0.2 HP2 Rev 1
NetWare 6.5.6
GroupWise set to High security


I was checking my POA log and noticed three of my accounts showing a Login
via GWIA/Pop with an ip address from China multiple times an hour or day.
The log is as follows (I have removed the Id):

19:06:32 300 C/S Login GWIA/Pop ::GW Id=XXXXXX :: 123.112.128.52
[192.168.100.21]
19:07:22 300 C/S Login GWIA/Pop ::GW Id=XXXXX :: 123.112.128.52
[192.168.100.21]
19:09:57 300 C/S Login GWIA/Pop ::GW Id=XXXXXXXX :: 123.112.128.52
[192.168.100.21]

I'm also seeing the same activity from another China based ipaddress of
58.240.104.3

The 192.168.100.21 is the internal address of my GroupWise box. I had all of
the accounts change their passwords and yet I'm still seeing this in the
logs. Is there someway that someone could be getting into the accounts
without knowing the password?

B.