Tim to be very clear here, there are several observations, and they may all be linked to the same root cause (you may have other observations from other people too).

What I am expecting the solution to be is your plugin reports “admin” attempts to log in to the site (probably bots) or other user names that fail to get into the site.
If admin is not a valid user name (confirmed by checking the database) then it is not reported as a valid user. Conversely if it is, then it is reported as such. (It would be useful to confirm how you are making this decision).
We also have this third case where a site which had been under attack for over 12 hours using admin and several other guessed names was not being reported at all by the dashboard, however WordFence was still sending out emails about it. So here there was a disconnect too.

I appreciate all you are doing, but felt it was worth raising this to the top of the list again, as I am very concerned that you have identified “admin” as a valid user on systems where I know “admin” does not exist. So there was always the possibility that you knew more about my sites than I did and had identified a potential compromise.

Is there any progress on this? I see that many others have highlighted this but there is no further information. While many here are not paying customers, we are helping to promote the popularity of your plugin and get the bugs out. It would be good if you can tell us if the entries which say admin is an existing user, vs admin is not an existing user is relevant.

The implications being that admin = an existing user, where none of us believe admin exists on our sites may mean it is compromised. As authors of a security plugin, I would have hoped that by now you could tell us one way or the other even if a patch is not available yet.

Replying to Tim
I do not believe I have ever used the user name “admin” because I always overwrite it with something else. It is a very well documented hacker target. Even if it was used, I could not locate any reference to it in the MySQL database, but am happy to help you to get to the bottom of this.

Bottom line is I have seen three reports for websites where the username “admin” does not exist on the users page:
1). admin is an Existing User
2). admin is not an Existing User
3). A site under a distributed attack with the name “user” being used for 4hrs and reported by WordFence that it is happening, has no reference to the username “admin” in the dashboard.

So something is wrong here somewhere. I am particularly concerned about the dashboard report that tells me admin is an existing user, as this indicates that someone/thing has logged in as admin.

I know that some hackers try to access sites as User “0” which by default if it is not changed when the site is installed also carries the username “admin”. Any chance someone has coded it wrong?

A further comment on this, I have just looked at another site I have which also uses WordFence, in this case it has been under attack for over 4 hours with a distributed brute force attempt to login with the username “admin”. As with the other cases above, this site does not use “admin” as a username. What is really odd given my earlier comments is that in this case there is no reference to the attempted logins in your dashboard panel, even though it is WordFence reporting them! So in this case, I know for sure that admin is being attempted on this site, but your dashboard panel does not list them at all, either as Existing Users or not.
So now I am more confused than ever. Has this feature (which in principle is a good one), been tested at all?

Many thanks to the author response and the response from Mike.s
It looks like something was introduced from 3.4 onwards. I will not make any changes, all I need to remember is turn it off before I create a newsletter.
I automatically update the plugins and code on all sites as a matter of policy, (I have around 50 sites) so going back to an older version will not work for me.

As I said earlier, the plugin is great, I only need to turn it off to see the volume of automated spam comments it is detecting, so I do wish to continue using it.

Many thanks for the help provided here and helping to establish where the issue is.

Thanks Andrew, yes I have seen that article. I have not been hacked recently, my thread is about the correlation between updating something and then finding dozens of hackers trying to get into the most recently updated sites. They must be finding out somehow, it is too much of a co-incidence.