Seems that I have the same problem here.
WP-login.php is blocked to all IP except mine using .htaccess:
<FilesMatch "^(wp-login\.php)">
Order Deny,Allow
Allow from "My own external IP"
Deny from all
</FilesMatch>
I’ve received today a notification saying another IP (which should not be allowed) has been blocked:
9 failed login attempts (3 lockout(s)) from IP: xxx.xxx.xxx.xxx
Last user attempted: xxxxxxxx
IP was blocked for 24 hours
I really don’t understand how this could happen. Note that I also use BPS Pro Plugin.
Any idea?