Security-login attempt

I have a WP site with 2 admin users, no standard admin account.
Ithemes Security plugin running
Right file permissions for maps, files etc.

Yesterday there were login attempts with only these two usernames, first username may be guessed because person is publishing articles, second username not.

Attempts were during 20 minutes, from i.p. adresses all over Europe.
How can the second username be used by the wannabee intruders?