Confused by dovecot: auth: unknown user in logs

[Tuxicoman2]

I see those lines in container logs when I receive a message on an alias:

2026-08-19T12:54:58.318717+02:00 mail dovecot: auth: passwd-file(@.*,185.93.89.36): unknown user (SHA1 of given password: a9d8dd)

It seems confusing with a login attempt to take over a regular mail account.
Do you see the same?