how did you go with this?
also, i found an interesting little bit of information (that I'm sure everyone else has found well before me, but i havent had too many windows 7 systems come through)
searching for "Boot Session" in the setupapi.dev.log will give you all the times the computer was turned on, which you may be able to use to coroborate your login events. Havent done much testing to see whether restarts are recorded as boot sessions, but still useful to put in the timeline
Job is finished for the moment, the client was happy with what he got from my initial report.
He was trying to show an employee was continually late to work but the logon events weren't really too much help because they indicated that the computer wasn't shut down every night, there were a lot of 'screen saver' logon events.
In the end the client wasn't willing to spend any extra money to have me dig around and try to clarify so at the moment it's on hold/finished.