Usernames nobody on your site has

admin, administrator, root, test, user, guest, webmaster, support, demo, wordpress, wp-admin, sysadmin.

No real person on a WordPress site is signing in as one of those, so a request that tries is a machine working from a list and can be told no immediately.

Checked against your own users first. If your site genuinely has a user called support, that name is not refused — a plugin that broke the site it was installed to protect would be a bad trade. Switch the whole thing off in Settings if you prefer.

A refused name is not counted as a wrong password, so trying it never locks anybody out. A real account with one of these names is counted like any other, which is one thing the sign-in page still gives away: see Not telling a machine which half was wrong.