Brute force attack uses correct username?

Hello I have a question;

I have a new site with a fresh wordpress installation. I use a very unusual admin username.

Today I get persistent lockout notifications where the attack script uses the correct username.

No blog is active, no posts have been published or other custom post types where the username would be visible.

I have not seen this before. Nothing happened, wordfence works perfectly. But how can the attacker script use the correct admin username?

If someone knows an answer how this can prevented I would be grateful.

Jason