Hi Herc
To be honest, you really should only have an administrator account and possibly a couple of users you've added yourself.
If there are accounts prefixed with "IUSR_" these are for IIS webserver. Since you are apparently not using IIS (which is fair enough, it's your PC not a webserver!) then you can disregard and delete them.
I really wouldn't worry a great deal about them though.
You have ZoneAlarm protecting you from people trying to access the server capabilities of your system, so provided you've got that set up and working alright you will get a warning from it if you have unauthorized login attempts from the Internet.
It's also good practice to shutdown any server processes that aren't needed - have a look at your Services (Control Panel > Administrative Tools > Services) and shutdown IIS and any other "obviously not needed" services. Best done with care though - but look for IIS / Personal Web server and things like that.
Enjoy your dinner
JJ