Security Events Shows A New User Account Setup By Accessing my Network with a Profile

Question

Can you tell me, please, if this is the result of a hack?
Mine is the 1st ID and Name. 
Subject:
Security ID: GATEWAY\Angela
Account Name: Angela
Account Domain: GATEWAY
Logon ID: 0x2CBED
Additional Information:
Caller Workstation: GATEWAY
Target Account Name: Administrator
Target Account Domain: GATEWAY"
Audit Success 2/5/2014 12:49:45 AM Microsoft-Windows-Security-Auditing 4672 Special Logon "Special privileges assigned to new logon.
Subject:
Security ID: SYSTEM
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7
Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege"
Audit Success 2/5/2014 12:49:45 AM Microsoft-Windows-Security-Auditing 4624 Logon "An account was successfully logged on.
Subject:
Security ID: SYSTEM
Account Name: GATEWAY$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Logon Type: 5
Impersonation Level: Impersonation
New Logon:
Security ID: SYSTEM
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7
Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information:
Process ID: 0x250
Process Name: C:\Windows\System32\services.exe
Network Information:
Workstation Name:
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Advapi  
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
I also suddenly have a 'switch user' on my windows logon screen, have files appearing and disappearing, see someone logging in with a temp profile, then a manual
profile, then an automatic profile (created from the profile examples given), logons between midnight and 2am, User Profiles Service 3, 4, 1, 5, 67, 5 and 2 over a 5 minute period at 1:10am on 2/3, etc.
I need to load my husbands PC (I reloaded mine and the problem continued, and need to know how to protect him from this, if necessary.
How do I proceed?

Answer 1

Hi,
Gnerally speaking, the events you list above just sytem service or application need to use system resource, then Event Viewer would record their activity. You can use Filter(filter event ID, such as 4624) to check, you will find plenty of events like new
account logon.
About your another question, you can access to User Managment to check your sytem current user, if there is any other new user has been created.
Win+X, choose Computer Managment, Local Users and Groups
Roger Lu
TechNet Community Support