I'd try the XP boot disk first because I seem to remember there being a default Administrator account that is enabled even if its not shown, but can be affirmatively disabled by policy settings. But maybe you've already tried that.
For local accounts, you can use a linux boot disk to reset the password:
http://pogostick.net/~pnh/ntpasswd/.
Thats a pretty simple command line tool that has worked for me numerous times.
You can also use a linux boot disk to decrypt the encrypted password hashes and then try running the hashes against Rainbow Tables:
http://ophcrack.sourceforge.net/.
(This takes a while and is not even guaranteed to work if you have a strong password -- only recommended if you need to know the acct password and cannot reset it)