Hmm.... this is interesting!
I think I figured out the issue. Logwatch sent me a message telling me that this user above had tried to get in. It turns out that Logwatch lied to me as that was last year but because it was the same month and no year printed in the logfile (not sure why newsyslog didn't role the file over for all this time), Logwatch got confused and served that up in it's recent log report nearly giving me a heart attack
Well looks like my rules are working fine then :-S