Penetration Testing: XP RDP event log 682 ?

["BillyBob" <billybobknob () hotmail com>]

I have a few event log 682's (user has reconnected to a disconnected TS
session) on an XP machine at work that shows:
Session Name:    Console
Client Name:    Unknown
Client Address:    Unknown

All other event log 682's show Session Name:    RDP-Tcp# and they also
display the Client Name and Address.

Does this mean that these Unknown ones connected via Console were
connections made by someone who hacked the password and used a stealthed OS
?

Thanks,
Bill