Hopefully the Duplicati programmer can help. Some previous notes:
Except yours wasn’t log output. For the first, invalid password shouldn’t be fatal.
I think the login attempts can come from the open browser tabs, or the TrayIcon.
For browser tabs, you could either start logging or close them and see if it helps.
Logging depends on browser, but it’s often in developer tools or click on F12 key. Goal is to see what went in, although I wouldn’t expect much without user action.
What browser is this? If you close Duplicati tabs, it might not matter. Otherwise, it might. Refresh seen is the kind of thing that might happen after 15 active minutes.
Developer might have a better idea.