Sounds like your server is being "dictionary attacked", i.e. bad guys are looking for valid mail addresses by trying many different common ones. In other words they try many and the ones that don't result in the "unknown user" response, they add to their spam lists.
Unfortunately this is a standard spammer operation.
It's also standard procedure for several mail viruses including much of the MyDoom family to generate additional addresses by mixing and matching username and domain parts it finds. Thus, it's also very common to get a spike in "unknown user" messages when a new virus breaks out.
