SQL Alert: 020 - SSPI handshake failure. Tracking the cause?
Usually when you get the SSPI notification (or from the error log ), you will see the IP address from which the app\user tried to connect. The IP may be internal or external. 

Just launch the command line and type:

NSlookup IP


(using the IP address from the log). This will give you the hostname from which the connection request came.