[Plugin: All In One WP Security & Firewall] Have I been hacked?

I am getting dozens and dozens of login attempts from a personal account belonging to me that is not my main blog account and no one besides me could possibly know about.

Have I been hacked? What’s going on?

This is a user account I created and added to my WordPress under its own separate Gmail account, purely for testing out WordPress stuff such as how author accounts work. I never go through with public posts or comments (I just delete them).

So out of the trillions of usernames out there why am I getting ‘attack’ login attempts only from this secret one and no others?

I have only this one blog and run it myself. There are no other authors or other people involved.

Finally –

The return address on the lockout notification emails is ***my own personal address***. Why is this? Whenever I get “Please moderate” emails about comments awaiting approval, they come from wordpress@[mysitename].org

All in One v3.8.9

other plugins:

Email subscription
Subscribe Button by AddToAny
WordPress Importer
WP Statistics
WP Super Cache

Akismet, but it is not activated.

———————————————–

A lockdown event has occurred due to too many failed login attempts or invalid username:
Username: [here it has my ‘test’ username discussed above]

IP Address: 103.27.127.238
IP Range: 103.27.127.*

Log into your site’s WordPress administration panel to see the duration of the lockout or to unlock the user.
https://www.ads-software.com/plugins/all-in-one-wp-security-and-firewall/
———————————–