I found following record in the windows event log:
Application popup: Windows : Other people are logged on to this computer. Shutting down Windows might cause them to lose data. Do you want to continue shutting down?
I wonder is it possible to get username of that who tried to login and got that message.