Letters OR appearing above Username on /wp-login.php url

See the screenshot here of what I’m exactly talking about: https://www.emeraldcityarms.com/login-error.png

I tried editing the login.css file for a custom login page and then this appeared. I reverted the changes and it’s still there.
I restored the login.css from backup, no luck.
I even copied login.css from another wordpress install and still no dice.
did the same for wp-login.php, didn’t fix it.

Looking at the source code once the page is loaded I see the following:

<script type="text/javascript">if(jQuery.type(has_social_form)==="undefined"){var has_social_form=false;var socialLogins=null;}
jQuery(document).ready(function(){(function($){if(!has_social_form){has_social_form=true;var loginForm=$('#loginform,#registerform,#front-login-form,#setupform');socialLogins=$('<div class="newsociallogins" style="text-align: center;"><div style="clear:both;"></div></div>');if(loginForm.find('input').length>0)
loginForm.prepend("<h3 style='text-align:center;'>OR</h3>");loginForm.prepend(socialLogins);socialLogins=loginForm.find('.newsociallogins');}
if(!window.fb_added){socialLogins.prepend('<a href=\"https://www.emeraldcityarms.com/wp-login.php?loginFacebook=1\" rel=\"nofollow\"></a><br />');window.fb_added=true;}}(jQuery));});</script>

So… awesome, it shows up there, but where the heck is it grabbing that data from?!

I have SSH access to the server and run some search commands to find certain words in files (i.e. >OR< and found nothing.

wp-login.php and /wp-admin are currently blocked off by ip address, so you’ll get a 404 trying to access it.

any pointers/tips?

Thanks