I’d be curious as well, but chances are they’re experiencing credential stuffing attacks or dictionary attacks against account passwords.