Usually, this activity comes about because they are have found a hack. So check your installed and UNINSTALLED themes for Nova. If it's uninstalled please remove it. While your at it...(here comes the broken record) spend the 10 minutes and delete all your uninstalled themes!
Also, I'm seeing a lot of trolls from different ip addresses using the HTTP command /wp-admin/ or /blogname/wp-admin/ the effect of which is to call wp-login. I don't understand the behavior; why not just call login?