I am concerned that one of our servers is being abused for a few various reasons.
Is there a tool that can send a popup message when ever a user logons onto the server?
Unfortunately Windows does not have a mechanism for doing what you want, so the simplest solution by far is to do as Nick has already said.
Faced with a similar need for one particular user account I use logon and logoff scripts that utilise Blat to send me an email whenever that accounts is logged on or off. Simple, bordering on being crude, but surprisingly effective. Even more importantly, I receive the notification even if my machine is off at the moment the logon/logoff occurs. Additionally, the script, appends the time and date to a log file, which is easier to read than the Windows event logs.
Why not just look for logon events in the server's event log?