I receive a " SECURITY information for user " email that says:
machine : Apr 18 21:07:59 : user : 1 incorrect password attempt ; TTY=pts/4 ; PWD=/home/user ; USER=root ; COMMAND=/usr/lib/x86_64-linux-gnu/libexec/kf5/kdesu_stub - It seems that a wrong password is passed PWD=/home/user