Are Admin Usernames Public? Suggestions needed.

I recently moved a site of mine to a new host, and from day one was inundated by Wordfence alerts about attempted logins.

Most of these have been with the standard ‘admin’ username, but a couple have been specific to my site (i.e, actual users). I had already tightened my security protocols in Wordfence, but recently took the step of removing the existing admins, blocking any attempt to log in using some usernames, and creating a new, non-public posting, admin with a strong unique password.

A few days passed without any attempts to log in whatsoever, and then today I’ve received alerts of two attempts to log in as the newly created (and very randomly-named) new admin.

This, obviously, has me scratching my head. Does anyone know if WordPress makes user lists public – either by design, or by user/owner error. Because I have no idea how the name would be known otherwise.

I’m using a secure and unique password, but I’m a little concerned by this whole thing.

any thoughts?