Since this is the admin login being effected, I'd be looking at that table in the database poste-haste to see if any changes, (like new admins), have been added.