Messages for invalid password and invalid user name are different.
vulners.com/securityvulns/securityvulns:doc:15724