Network (IP) address is no longer listed as the source of multiple failed login attempts - Events 4776 in Windows 2008 R2

Question

Our Windows 2008R2 security log is full of failed login attempt events 4776, but we're unable to block them because no IP address is provided for the network source of these attempts - like it was in Windows 2003 Server.
Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          9/26/2012 2:32:27 AM
Event ID:      4776
Task Category: Credential Validation
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      MAIL.XYZ.COM
Description:
The computer attempted to validate the credentials for an account.
Authentication Package:    MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:    admin
Source Workstation:    MAIL
Error Code:    0xc0000064
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4776</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>14336</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2012-09-26T06:32:27.570062500Z" />
    <EventRecordID>18318</EventRecordID>
    <Correlation />
    <Execution ProcessID="452" ThreadID="540" />
    <Channel>Security</Channel>
    <Computer>MAIL.XYZ.COM</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="PackageName">MICROSOFT_AUTHENTICATION_PACKAGE_V1_0</Data>
    <Data Name="TargetUserName">admin</Data>
    <Data Name="Workstation">MAIL</Data>
    <Data Name="Status">0xc0000064</Data>
  </EventData>
</Event>

Answer 1

The user names are all different in these log events, and they constantly change, which may indicate a hacking attempt.  However, in Windows 2003 these type of events looked like this, showing the IP address the request came from, so we could trace
and block them -- but not in Windows 2008:
Logon Failure:
Reason: Unknown user name or bad password
User Name: s
Domain: MAIL
Logon Type: 10
Logon Process: User32 
Authentication Package: Negotiate
Workstation Name: MAIL
Caller User Name: MAIL$
Caller Domain: XXXX
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 3728
Transited Services: -
Source Network Address: 202.67.170.186
Source Port: 57365