For a the last year or so, Bots have been attempting to login with empty usernames.

What started as a trickle started to become a flood, so now v4.3 has a new "extra" filter to catch this.

I suggest you use the Remote Tools add-on (or your favourite text editor) to move the rule to "hard" or "soft" as necessary for your environment.