repeated port 21 attempts

[Jacob Wu]

I'm getting port 21 connection attempts every 5 minutes from about
half a dozen of my network users.  These attempts are repeating
regularly with one computer sending out 1500+ attempts a day.  I have
not seen this before and I'm wondering if anyone else here has seen a
client behave this way before?

My initial thoughts were: hacker, virus/trojan/spy ware or badly
configured program.  I ruled hacker out right away when talking to the
clients and realizing they didn't even understand the concept of
ports.  After receiving the machines from the clients and doing
vigorous virus/trojan/spy ware scans I have found nothing known on
them.

Anyone got anything?  Is this something new?