LEM log question

Hi,

We have started seeing in LEM UserLogonFailure  account@corp.domain.local. This does not effect the user from logging in. My question is in LEM it shows the destination account as root not the account name.  Where does this account called root come from? We have no root account in AD.

Thanks,

-Pat