Two systems with identical parameter counts can behave dramatically differently depending on how they are built.
Credential stuffing tests stolen password lists against your login form until one matches. Here is how to spot the traffic ...