Introduction To Splunk & SPL (skills assessment)

Hey guys, noob here – this is about the last question on the skills assessment for “Introduction To Splunk & SPL”. The one with the 10min interval. I found the answer but there was a little bit of guesswork here. I was wondering if anyone can explain to me why the answer is THAT user and not the other ones? There were other accounts with higher logon attempts.

Any help would be appreciated.