The administrator should track the source of the log-in attempts and block the IP address in the Web Application Firewall (WAF). This will prevent further unauthorized attempts from that source.
It is also advisable to reset the user's account credentials as a precautionary measure.