Below is the raw original email header. There is a definite problem. Wordfence is initiating, somehow, these alerts. Ran it by TMD as well.
This alert was generated by Wordfence on "Foreclosurepedia" at Sunday 7th of September 2014 at 07:29:21 PM
The Wordfence administrative URL for this site is: http://foreclosurepedia.org/wp-admin/admin.php?page=Wordfence
Delivered-To: coo@foreclosurepedia.org
Received: by xxxxxx with SMTP id xxxxx;
Sun, 7 Sep 2014 17:29:25 -0700 (PDT)
X-Received: by xxxx with SMTP id mc9mr28xxxxxxxx136164452;
Sun, 07 Sep 2014 17:29:24 -0700 (PDT)
Return-Path: <foreclos@nodexx.tmdhostingxx.com>
Received: from mxx.tmdhosting.com (mxx.tmdhosting.com. [19xxxx2])
by mx.google.com with ESMTPS id f8si941xxxicz.73.2014.09.07.17.29.24
for <coo@foreclosurepedia.org>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Sun, 07 Sep 2014 17:29:24 -0700 (PDT)
Received-SPF: none (google.com: foreclos@node01.tmdhosting810.com does not designate permitted sender hosts) client-ip=198.143.161.162;
Authentication-Results: mx.google.com;
spf=neutral (google.com: foreclos@node01.tmdhosting810.com does not designate permitted sender hosts) smtp.mail=foreclos@nodexx.tmdhostingxx.com
Received: from new.tmdhostingxx.com ([xxxx0.114] helo=nodexx.tmdhostingxx.com)
by mxxx.tmdhosting.com with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.82)
(envelope-from <foreclos@node01.tmdhosting810.com>)
id 1XQmpe-0002Gy-Bi
for coo@foreclosurepedia.org; Sun, 07 Sep 2014 19:29:24 -0500
Received: from foreclos by node01.tmdhosting810.com with local (Exim 4.80.1)
(envelope-from <foreclos@node01.tmdhosting810.com>)
id 1XQmpe-002nc8-0t
for coo@foreclosurepedia.org; Sun, 07 Sep 2014 19:29:22 -0500
To: coo@foreclosurepedia.org
Subject: [Wordfence Alert] foreclosurepedia.org User locked out from signing in
X-PHP-Script: foreclosurepedia.com/wp-login.php for 213.97.128.187
Date: Mon, 8 Sep 2014 00:29:21 +0000
From: WordPress <wordpress@foreclosurepedia.com>
Message-ID: <6f6cb75505afc073f4369eac3876e89a@foreclosurepedia.com>
X-Priority: 3
A user with IP address 213.97.128.187 has been locked out from the signing in or using the password recovery form for the following reason: Exceeded the maximum number of login failures which is: 3. The last username they tried to sign in with was: 'Editor-in-Chief'
User IP: 213.97.128.187
User hostname: 187.Red-213-97-128.staticIP.rima-tde.net
--
To change your alert options for Wordfence, visit:
http://foreclosurepedia.org/wp-admin/admin.php?page=WordfenceSecOpt
To see current Wordfence alerts, visit:
http://foreclosurepedia.org/wp-admin/admin.php?page=Wordfence