how to identify the usage of an specific sql login
As all the sessions for that user are system processes per your comment, this is the system itself, i.e. the "sa" account and/or the SQL Server Service account using Trusted Authentication.