Hi Penny

The login errors means that one of the methods to authenticate users may not be working.

Totara has a number of methods to authenticate users including email self registration, database authentication. You can see these methods under

Site Administration > Users > Authentication >Manage Authentication

A site can have several authentication methods enabled at once - these can be arranged in an order of priority and each one of these authentication methods has customisable settings.

As well as this each user can have an authentication method assigned against them.

As a result it is possible to get an authentication conflict which is where the message is being recorded  in the log but an alternative authentication method manages to login the user.

That's my theory - although it could be someone trying to use someone else's login.

Craig