Invalid Sign-on Attempts and How They're Logged

Does anyone know the precise circumstances under which certain
characters are written to the audit journal for invalid attempts
occurring from the CA prompt?

For instance, these entries show up in a query report of invalid
attempts (bad profile):

04/04/22   9:15:51  Q1          B27D0170S1
04/04/22   9:46:27  Q1          B04D0128G1
04/04/22  17:10:27  Q12345      Communications Device
04/04/22  10:50:36  Q218        B40D0133G0           
04/04/22  11:48:58  Q22010      B32D0108S1           
04/04/22   7:50:00  Q3          QPADEV0003           

The "Q12345" entry was created by me on purpose.  I typed 12345 in the
User ID field of the Signon to iSeries box.  Is it safe to assume the
others are instances where those particular digits were entered and the
Q is placed there by the OS?

Best regards,

Steven W. Martinson, CISSP, CISM
Manager of OutLink Security
Jack Henry & Associates, Inc.
7800 Willowchase Blvd.
Houston, TX.  77070
     voice              281.517.8000
     external fax       281.517.8157
     internal ext       471800