Questionable alerts

I received 3 alert emails last night, stating that the user had attempted to login over 20 times, each message referring to a different (nonexistent) user name. The messages said that the user’s IP had been blocked from signing in and password recovery.

1. The IP given is the IP of the server on which the site resides

2. In looking at the WF info afterwards, there are no IP addresses listed as being blocked under any category (though I don’t see a tab for Password Recovery).

https://wordpress.org/plugins/wordfence/