Another option is just that users are typing their password wrong occasionally - the login error message will be logged any time a login attempt fails.

Simon