Brute force attack on my site even after I disabled my login form

Hi,

I enabled Clef few days ago. I Disabled login form and using override url in case of emergency and almost exclusively I am using Clef app on my phone. Today I got 2 emails from Wordfence Monitoring plugin.

A user with IP address 193.201.225.43 has been locked out from the signing in or using the password recovery form for the following reason: Exceeded the maximum number of login failures which is: 5. The last username they tried to sign in with was: ‘admin’
User IP: 193.201.225.43
User hostname: 193.201.225.43
User location: Ukraine

After I disabling my login form how can he able to visit the login page where he doesn’t have access to my override URL provided by Clef?

Am I missing something?

https://www.ads-software.com/plugins/wpclef/