I have two user accounts on my PC. About 2 years ago I was doing some testing and left one of my local accounts open to RDP with no password accidentally for about a month.
A hacker got in and started screwing around before I caught him, and realized the account was open and quickly locked things down. No serious harm was done, and I removed the ability for anyone to login on the compromised account.
That PC no longer exists and the boot drive is completely different, but I have replaced it with another PC using the same user-account names (they make sense). A week ago I realized that computers in Russia, Latvia, and China were hammering my RDP port pretty hard. Most of them are trying random account names like "MARY", "ADMIN", "RYDER", etc., but disturbingly I've noticed that sometimes they are directly referencing the two user accounts on my system (although this seems to usually come from the same CIDR /16 sub blocks).
I've been banning these ranges, but I'm wondering if these account names are in some way being exposed to the outside? Is it possible they've just "wrote" down the account names they were able to see when my PC was stupidly open, and now those accounts are on a list somewhere?
I've taken other security precautions and changed my passwords, changed my RDP port, etc., so I'm not terribly concerned, but it is disconcerting.