...which i'd assume you are when building a Universal Image for XP, there is a section in it that might look like this:
[GuiUnattended]
AdminPassword="xxxxxxxxxxx"
EncryptedAdminPassword=NO
AutoLogon=Yes
AutoLogonCount=3
If that is set, i'd assume that it might override your default settings in the image (never tested this theory though...). However, bhawver could also have a very good point...if you're joining a domain, a Group Policy might be changing these settings as well.
Simplest thing might just be to go through your build chain, and as one of the last steps, have it run a regedit and plug in your autologin keys and then reboot! If it still does it after that, i'd be almost positive that this is being managed by Group Policy somehow.
Let us know how it goes...