Attempts to login as administrator

I’ve recently installed WordFence on three small sites that I run. Within a few days, I’ve started getting WordFence alerts “User locked out from signing in” from each of the sites. In each case the username used was the admin user for the site (which was not ‘admin’, and was different for each site). I haven’t had a deluge of alerts about random login attempts, just these few targeted ones. The attacks have come from the US, India, and the UK. (I’m in the UK). Two of the sites are on a paid-for hosting service, the other is on my own VPS.

It just makes me wonder how these attackers knew which user names to try.