Sucuri – User authentication failed: Unknown user

We have recently installed several plugins to combat brute force login attacks. These plugins are:

Login Lockdown – suspend IP after repeated failed login attempts

HumanCaptcha – Captcha with human readable questions/answers

Protect Your Admin (Protect WP Admin) – change url of /login/, /login.php, and /wp-admin/.

Sucuri – monitor login attempts

The flood of login attempts with user of admin has stopped. But Sucuri shows me repeated failed login attempts with user listed as unknown. The IP of these attacks is always somewhere in Eastern Europe.

Can anyone explain to me how a person or a robot can attempt to login without a userid? Or, how can they circumvent not knowing the url to login?

BTW, we do not have a userid of admin, nor do we have a userid of 1. Also, these login attempts are happening in the early morning hours, before Americans are awake.

Thanks,